Take the 2-minute tour ×

Im just wondering, would the following be completely safe or would someone be able to get around it using hexadecimal characters, etc:

$name = mysql_real_escape_string(htmlentities(stripslashes($_REQUEST['name'])));
$query ="SELECT * FROM Games WHERE name LIKE '%{$name}%'";


I know I can use PEAR and other libraries to make prepeared statements. However this question is specifically regaring raw queries.

share|improve this question
You seem to be confusing XSS (injecting javascript into webpages) with SQL injection (injecting SQL commands into an SQL variable). You should always defend against SQL injection before saving data into the database. You should, in most cases, only defend against XSS when you are about to use the data (which you have already saved in the database) in a web page, beacuse you can use the dame data in multiple places, and different types of XSS protection might be necessary in different places. –  Tgr Aug 25 '10 at 12:44
No, he's not confusing anything. He's rightly refusing to trust the structure of input. This guy shouldn't need to know what all the exploits are. He just needs a reliable way of ruling them out. –  Ian Aug 25 '10 at 13:05
Yes he is confusing it. The data should be made safe according to the requirements of where it is going, and only at the point where it leaves the PHP code. i.e. mysql_escape_string() (ONLY!) when writing to database, htmlentities() (ONLY!) when writing to the browser. Stripslashes() should never be used in addition to another escaping mechanism and only when there is no target-specific escaping function. –  symcbean Aug 25 '10 at 13:10
@Ian that's just impossible. –  Your Common Sense Aug 25 '10 at 13:27
though I'd agree that he is not confusing anything. But just throw in everything he's got :) –  Your Common Sense Aug 25 '10 at 13:29
show 2 more comments

5 Answers

mysql_real_escape_string does the trick,.,


for string use:

$str = mysql_real_escape_string($input);

for numeric values type casting is sufficient like:

$val = (int)$input;
share|improve this answer
-1 mysql_real_escape_string is an a bad choice, if security is the goal, there are some better ways to do this –  canni Aug 25 '10 at 12:02
i dont agree with you., mysql_real_escape_string is a perfect choice for escaping data being inserted into a table and prevents against sql injection,. there are many popular opensource projects using this approach wordpress is one,. –  ovais.tariq Aug 25 '10 at 12:09
one thing more i would like to add is that the biggest advantage of using mysql_real_escape_string lies in the fact that it takes characterset into account when deciding how to properly escape the data –  ovais.tariq Aug 25 '10 at 12:13
I agree, i even think that PDO's internals may use this function/algorithms from it, "not secure" heare is that You manually have to remember about escaping every input value (witch is the most common mistake, simple forget about it), and PDO's way would do this for You, in a abstraction layer –  canni Aug 25 '10 at 12:18
an abstraction layer does help things out i agree but that doesn't mean mysql_real_escape_string is a bad choice :) you could use PDO or any other abstraction layer –  ovais.tariq Aug 25 '10 at 12:27
show 20 more comments

Use parametrized prepared-statements, along with PDO, this will give You the most secure way of sending queries, that PHP can offer, and You'll not have to deal with escaping at all, using that way

share|improve this answer
Thanks, however not specific to the question of raw queries. –  pondpad Aug 25 '10 at 13:13
add comment

For the SQL just

$query ="SELECT * FROM Games WHERE name LIKE '%$name%'";

is enough.

More of that, using of htmlentities and stripslashes here is unecessary and buggy.
I doubt you want to search Dankesch&ouml;n instead of Dankeschön for example.

Note that mysql_real_escape_string obviously works for quoted strings only.

$num = mysql_real_escape_string($_REQUEST['num']);
$query ="SELECT * FROM Games WHERE salary > $num;

would not help

For the other uses there can be other validations.

share|improve this answer
add comment

mysql_real_escape_string is enough here and since you tagged it with xss, when reading it from the database and showing it in html use htmlentities to prevent xss.

share|improve this answer
I'd strongly suggest htmlspecialchars() instead of htmlentities(). this last one should be banned from usage as totally useless and wrong. Converting letters to entities will never help with security but will mess the source code. –  Your Common Sense Aug 25 '10 at 12:06
add comment

Either use parameterized SQL or enforced input filtering:

$query = "SELECT * FROM Games WHERE name LIKE '%{$_REQUEST->sql['name']}%'";

Manual escaping is pretty bad style, because it's too easily forgotten.

share|improve this answer
add comment

Your Answer


