Is this enough to tackle script / malicious code insertion in GET, POST requests?

Question

I've got legacy PHP code which attempts to prevent script/SQL injection with the following:

if (!empty($_POST)) {
    reset($_POST);
    while (list($k,$v)=each($_POST)) {
        if(!is_array($_POST{$k}))
        {
            $val=str_replace("&amp;","&",htmlentities($v,ENT_QUOTES));
            $$k=$val;
            //$_POST{$k}=$val;

            if (!get_magic_quotes_gpc())
            $_POST{$k}=$val;
            else
            $_POST{$k}=stripslashes($val);

        }
    }
}

The same is exactly replicated for $_GET as well.

Is this enough to prevent script/SQL injection?

user502 · Accepted Answer · 2011-02-11 14:28:24Z

7

No. It's blacklist-based, it tries to take care of specific tricks involving html entities. It doesn't even require magic_quotes, and magic_quotes has been deprecated as inadequate. Chris Shiflett is just one of many who've written a blog post explaining how vulnerable that is; it won't even stop modern automated script-kiddie attacks.

Use prepared statements in the database, and you'll be most of the way there--although even prepared statements aren't foolproof.

answered Feb 11, 2011 at 14:28

user502

3,3311 gold badge25 silver badges18 bronze badges

Add a comment |

Stack Exchange Network

Is this enough to tackle script / malicious code insertion in GET, POST requests?

1 Answer 1

You must log in to answer this question.

Linked

Hot Network Questions

Is this enough to tackle script / malicious code insertion in GET, POST requests?

1 Answer 1

You must log in to answer this question.

Linked

Related

Hot Network Questions