Escaping strings in database layer

Question

Can escaping functions (e.g. mysql_real_esacpe_string ) be moved down to the database layer where we would loop through all parameters passed for all queries and escape all strings. Would that be a good design?

score 5 · Accepted Answer · answered Apr 17 '11 at 08:13

5

In most other languages you would use "prepared statements" for this where you separate the SQL from the values.

Doesn't PHP provide the same facility?

answered Apr 17 '11 at 08:13

score 3 · Answer 2 · answered Apr 17 '11 at 10:07

3

PHP does provide a good emulation of prepared statements through the built-in PDO library. Use this for SQL if you can. The mysql_* functions are quick, dirty and legacy.

answered Apr 17 '11 at 10:07

Ben XO

301

score 0 · Answer 3 · answered Apr 17 '11 at 08:10

It would not be good design.

Use one of the common escaping libraries to escape the parameters.

Rolling out your own is error prone, especially in the database (where it might be subverted by a cleverly written parameter).

Additionally, SQL is fairly poor at string manipulation, so also a bad choice on this point.

Escaping strings in database layer

3 Answers3