Secure SQL Techniques

cotton31 · 12 Mar 2009 at 11:56

I'm working on a CMS which requests data from a mySQL database. I'm aware that this needs to be secure to prevent unwanted code from being executed.

How would I go about this?

I know this is quite a vague question, I just want to check that what I have will work.

If you need more details, let me know.

Cheers,

Talbs13 · 12 Mar 2009 at 12:00

You can use mysql_real_escape_string();

cotton31 · 12 Mar 2009 at 12:03

Talbs13 said:
You can use mysql_real_escape_string();

Sorry but how/where would I use that. First time dealing with mySQL (its a bit of a learning project

)

Stretch · 12 Mar 2009 at 12:13

Using stored procedures goes along way to preventing SQL injection.

cotton31 · 12 Mar 2009 at 12:41

I'll have a read up on stored procedures later on - not really sure what they are.

Cheers,

philjohn · 12 Mar 2009 at 12:49

Or using prepared statements.