egghelp/eggheads community

[solved-ish] prevent sql injection?

2008-03-28T12:25:29-04:00

A good general security rule, when dealing with suspect input, is to have a list of allowed chars (A-Za-z0-9, etc), rather than a list of disallowed chars (more likely to overlook some chars when trying to disallow.) The allowed list would likely be shorter as well.

good point, thankyou

Statistics: Posted by lenore — Fri Mar 28, 2008 12:25 pm

[solved-ish] prevent sql injection?

2008-03-23T02:25:46-04:00

A good general security rule, when dealing with suspect input, is to have a list of allowed chars (A-Za-z0-9, etc), rather than a list of disallowed chars (more likely to overlook some chars when trying to disallow.) The allowed list would likely be shorter as well.

Statistics: Posted by rosc2112 — Sun Mar 23, 2008 2:25 am

[solved-ish] prevent sql injection?

2008-03-23T02:01:22-04:00

If you use mysqltcl then mysql::escape should work fine.

Statistics: Posted by metroid — Sun Mar 23, 2008 2:01 am

[solved-ish] prevent sql injection?

2008-03-22T22:28:25-04:00

thanks chaps (goes to post the next question)

Statistics: Posted by lenore — Sat Mar 22, 2008 10:28 pm

[solved-ish] prevent sql injection?

2008-03-22T17:52:18-04:00

Actually that'll cause an error, use

Code:

set washed [string map {\" \\\" ' \\' ; \\;} $text]

Statistics: Posted by Sir_Fz — Sat Mar 22, 2008 5:52 pm

[solved-ish] prevent sql injection?

2008-03-22T14:09:07-04:00

Code:

set washed [string map {" \" ' \' ; \;} $text]

Statistics: Posted by speechles — Sat Mar 22, 2008 2:09 pm

[solved-ish] prevent sql injection?

2008-03-22T22:29:20-04:00

does tcl have a nice function for preventing sql injection? a wash function maybe? or am i just gonna have to regexp for ' " ; etc and escape them?

Statistics: Posted by lenore — Sat Mar 22, 2008 1:20 pm