Question

I have been doing a bit of research on SQL injections and so far all I can see is when you are concatenating query strings with variables, you have problems.

My question(s) is/are:

If I have this code:

$query  = "SELECT id, name, inserted, size FROM products";
$result = odbc_exec($conn, $query);

Am I subject to sql injection? I didn’t think so but I found a post on stackoverflow that indicated that it was.

Now if I have this code:

$variable = "name";
$query = "SELECT"' .$variable. ' FROM products";
$reulst = odbc_exec($conn, $query);

Am I still stubject to injection? It seems to me that I have full control of that variable and the code is run on the server side so that would be safe. Is this correct?

Thanks in advance for any input!

Answer 1

SQL injection is usually a problem if you have input from a source you can’t trust. Seeing as this is the case in neither of your examples, you’re fine as far as malicious attacks go.

However, it is good practice to escape $variable before inserting it into the query string even if you control it.