A través de tweako (visto hace algunos minutos en menéame) llegué a un artículo -en inglés- que explica como protegerse de ataques de Inyección de SQL con PHP. En el mencionado artículo, en la última parte aparecen las siguientes dos porciones de código:
# Ok, so I'm going to oversecure a query to the database that selects an article
# by using the given article ID.
# Here is the code.
//Database connection is present
//Make sure that the id is actually given
if (isset($_GET['id']))
{
$id = $_GET['id'];
}
else
{
die('Please provide an article ID');
}
//Make sure that its an integer
if (is_integer($id))
{
die('Please enter a valid article ID');
}
//Validate that its in between the ranges 1 and 10,000
if ($id < 1 || $id > 10000)
{
die('Please enter a valid artile ID');
}
//Construct the query
$SQL = "SELECT * FROM posts WHERE postID = '".$id."'";
echo $SQL; // Línea agregada
?>
# This next one will validate a username before its entered into the database.
//Database connection is present
//Make sure that the id is actually given
if (isset($_GET['username']))
{
$username = $_GET['username'];
}
else
{
die('Please provide a username');
}
//Get the length of the username
$length = strlen($username);
//Validate the length
if ($length < 3 || $length > 20) // parte modificada
{
die('Please enter a username between 3 and 20 characters long');
}
//Make sure that its safe to enter the database.
$username = mysql_real_escape_string($username);
//Construct the query
$SQL = "SELECT * FROM username WHERE username = '".$username."'";
//Show the username
echo 'Username: '.stripslashes($username);
//Send the query and close the connection to the database
?>
Los códigos mostrados ¿son correctos? si no es así, ¿qué errores tiene?.
