Question

Is there a list of SQL injection methods which can’t be protected with just using mysql_real_escape_string(); with utf8 encoding?

For integer, I’m using intval();
Is it secure enough?

For those who think I want to get “tutorial” to hack anyone: No, I won’t. I just want to know how to make my applications more secure, and I want to know if they’re secured 99% against hackers

Answer 1

If given a valid database connection, mysql_real_escape_string() is supposed to be safe for string data under all circumstances (with the rare exception described in this answer).

However, anything outside a string, it won’t escape:

$id = mysql_real_escape_string($_GET["id"]);

mysql_query("SELECT * FROM table WHERE id = $id");

is still vulnerable, because you don’t have to “break out” of a string to add an evil additional command.