Sql injection prevention techniques still vulnerable?

If I'm using mysql_real_escape_string and addslashes to avoid sql Injection attack in my website is this two are enough to sto开发者_如何学运维p SQL Injection so its 100% sure no one can now attack using SQL Injection?

---

It depends on your query; if you are talking about just the values you want to insert in your database, mysql_real_escape_string is enough, you don´t need addslashes.

If you also are talking about variable table or column names, you'll need white-lists as well as mysql_real_escape_string will not prevent sql injection on these.

So the answer really is: No, it depends on your query.

---

Don’t use addslashes at all; it’s not appropriate to protect against SQL injections.

Use mysql_real_escape_string only. And if you need to change the character encoding, use mysql_set_charset.

---

There isn't any simple "magical" way to prevent SQL injection. mysql_real_escape_string is a good start, using PDO (docs) is even better. Above all of that, you need to look at your database structure, look at your queries, look at your data sources, then think it out. Where is data coming from? What would happen if the data isn't what I expect?

The entire structure of your code should be created with a mind toward controlling the flow of your application logic. The best way to prevent SQL injection is to stay aware and in control of what goes in your database.

---

You should never use addslashes. Just stick with mysql_real_escape_string

Anyway only the death is sure.

And if you fear the death you should use PDO to be less prone to vulnerabilities

http://it.php.net/manual/en/pdo.prepare.php

---

Depends on what you mean, I suppose.

The mere use of mysql_real_escape_string will not protect you with 100% certainty, if for no other reason than that it is possible to use it incorrectly.

On the other hand, the correct use of mysql_real_escape_string should protect you as close to 100% as you can get.

On yet some other hand, it is probably easier to make mistakes as a programmer using mysql_real_escape_string compared to a parameterized query.

If you are unsure about your code, perhaps posting it and asking about it specifically may be more educational/useful.

Also: Ditto what others are saying regarding addslashes.