Question

Using the pg_escape_literal PHP function, I’m escaping my user input data as follows:

  <?php
  $dbconn = pg_connect('dbname=foo');
  $escaped = pg_escape_literal($_GET['name']);
  pg_query("INSERT INTO participants (name) VALUES ({$escaped})");
  ?>

Being new to PostgreSQL, my questions are:

• Is there a way to achieve an SQL injection given this code?
• Is there any other vulnerability that is left untreated in this code?

Using PHP 5.4 and PostgreSQL 9.2.

Answer 1

Since you do not trust any user input and you escape it accordingly, there is no injection in there.
Furthermore, you can use prepared statements to ensure you don’t forget any escape, and you take correct data types for the sentence.

Remember that if you forget only 1 escape, your whole system is compromised despite it may be escaped all the rest.