Question

I am thinking of practical solutions for this escaping methods. mysql_query doesn’t make two queries at once so the attacker can’t use things like ‘ OR 1; delete from user; select * from //he would guess the rest of the query here. (it becomes confusing)

(I obviously don’t like pdo, it is not practical in oop when you need to define a connection in each function of each class, otherwise I have to use $this or global $dbc each time.)

Answer 1

Not really, no. There are multiple ways that a query can be “unsafe”, besides burying a separate DML or DDL or statement. For example:

• A large, very-poorly-performing subquery could be used to bring your database to a crawl.
• A branch of the WHERE-clause could invoke an arbitrary stored procedure, with whatever effects that might have.

and every specific query would have to be vetted for the possibility of random code being inserted in the middle. For example, if the query results will somehow be presented to the user, then a subquery pointing at a table with authentication information could potentially let the user infer a great deal. (Imagine a series of tests where exists (select 1 from app_users where username = 'JoeAdmin' and password like 'a%'), then password like 'ba%' once the b is identified, and so on. Even if the hacker doesn’t initially know that you have a table named app_users, they can quickly figure that out by using this sort of approach on system tables.)