MSSQL - real_escape_string - Addslashes

[storm197]

Hi,

I wanted to make a topic with this subject.

I'm working with MSSQL and I want to secure the users input in my Queries.

Unfortunately, MSSQL function doesn't have a real_escape_string function that allow me to secure the info.

I read some topic of people suggesting to use the addslashes function, but mssql does not use the backslash character as an escape mechanism.

A function like this one could help, but, I don't think it's a complete secure solution.

<?php
function mssql_addslashes($data) {
$data = str_replace("'", "''", $data);
return $data;
}
?>
Can anyone gives me an advice on this one ?

 

[DRJ478]

What does MSSQL use to escape?

 

[storm197]

From what i've read, the escape character for MS-SQL is '' (two quotes).

I'll try it on my server.

 

[storm197]

That's exact.

For the "children's toy" string.

If I submit children's toy, SQL crash.

If I submit children''s toy, it works.

 

[DRJ478]

So, it seems to be just to replace single quotes with two single quotes. In that scenario I don't see anything wrong with the little function you provided in your initial post.
What are your concerns?

 

[sleipnir214]

Something like str_replace() can replace every single-quote with two single-quotes.


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[storm197]

My concerns are that the little function only handle quotes (').

If I look at php.net, it says that mysql_real_escape_string handle the following characters: NULL, \x00, \n, \r, \, ', " and \x1a.

If I just handle quotes, is that a big security breach in my system ?

 

[sleipnir214]

For what does MSSQL use backslashes?


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[storm197]

For what I know, backslashes seems to be a character like any other one. I've done a couple of tests, and MSSQL always return the value, with the backslash included.

 

[sleipnir214]

That takes care of all the backslash-escaped strings. We already know about single-quote.

What about doublequote and NULL?


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[storm197]

It's the same for doublequotes, MSSQL seems to take it as a normal character.

When the field is Null, is takes it as a blank variable.

If I write NULL, MSSQL takes it as a normal string.

So, after all, I think that checking only for quotes will do the job.

Thank for your support and advices.