How to prevent MySQL injection in forms?

Running your user-inputted data through the mysql_real_escape_string() is all you need to do.

It escapes all characters that could be used to mess with a SQL query.

Those functions return the reformatted string, so use it like this:

when some one attack on your database to get information without your knowledge is called mysql injection. it is just a mysql query to get information from your database. for example from your login table attacker can see the passwords by injecting sql. it is done when we have not applied strong server side scripting.

for detailed information check link

http://www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php

Microsoft UrlScan
Check SQL sintax

{links removed}

What mysql_real_escape_string does is take a string that is going to be used in a MySQL query and return the same string with all SQL Injection attempts safely escaped.

Yes we can prevent from sql injection through real_escape_string..

A MySQL injection attack occurs only when the user has permission to write something that is used as part of a query?

What about the ways in which the user can only select the radio button / checkbox / drop-down lists .. They can not really do many things SQL?

You can use stored procedure for prevent SQL injections. I have tried stores procedures in MS SQL and it working fine when SQL injection queries applied.

<?php
md5(serialize(base64_encode(mysql_real_escape_string($username)));
md5(serialize(base64_encode(mysql_real_escape_string($password)));
?

It's a bit of an overkill (there is no point doing all that, then md5'ing it), but you get my point. For things such as usernames and passwords you only really need to compare them, not much else.

every one is talking about in this forum to avoid sql injection through "real escape string " . But can any one tell me that How can we make its best use. and how can we prevent attacker from writing sql query on our page.

Use

Thanks john for this example..

thanks for the help !!

Really nice thread quite informative thanks to all.

An SQL injection is a common type of attack that uses malicious SQL code.

A few things to do:

1. Input validation and sanitation – writing code to illegally identify user inputs. Note that it’s impossible, though, to cover all scenarios
2. Use a WAF – a Web Application Firewall – so even if your code isn’t perfect (no ones is), you are still protected. You can read a good description about SQL injections from one vendor.