Question

I’m using the ezSQL PHP class for MySQL queries. Since all of my queries pass through the $ezsql->query() function, I thought it would be a good idea to implement a method to block common SQL injection techniques from $ezsql->query().

For example, the most common one is probably 1=1. So this regular expression should be able to block all variations of that:

preg_match('/(?:"|\')?(\d)(?:"|\')?=(?:"|\')?\1(?:"|\')?/',$query);

This would block "1"="1", '1'=1, 1=1, etc.

Is this a good idea? If so, what are some other common patterns?

Edit: Forgot to mention, I do use validation and sanitation. This is just an extra precaution.

Answer 1

Is this a good idea?

No. For two reasons:

1. You’re doing it wrong (yes you just failed with your bare approach of a SQL blacklist). And no, I won’t tell you how you could improve that because of 2:
2. It’s a blacklist approach. You should not use a blacklist approach inside the database class itself. That’s no added pre-caution, it’s just useless. Blacklist could be added additionally at the request level of the webserver for example.

Instead use an existing blacklist, don’t re-invent the wheel. If you want to learn how to develop your own SQL blacklist layer, help with the development of such existing components. This sort of security is not out-of-the-box so that you can just throw in a question like yours and you can actually expect concrete answers. Take care.