Does json_encode() protect against SQL injections?

Question

I noticed the function json_encode() automatically puts backslashes on " and ' values. I was originally protecting against SQL injections by using mysqli_real_escape_string($con, $value) before the string was put into the array, after then it would be encoded using jSON.

Because json_encode adds the additional back slashes, it is necessary to use the mysqli_real_escape_string function?

I wouldn't say this is a duplicate, this is purely aimed at the `json_encode()` function — Oliver Tappin, Mar 10 '13 at 18:04
Not constructive it is. Someone always comes up with various workarounds in order to eschew escaping, whether it is htmlspecialchars or addslashes or json_encode, like in your question. From your description (mysqli_real_escape_string and then json_encode is very much the wrong order) you seemingly also don't understand how context escaping should be done. Hencewhy the hint about bound parameters, which make this step redundant. What's your reasoning for avoiding the simpler and saner approach? — mario, Mar 10 '13 at 18:09
This is not a duplicate. Poor guy doesn't deserve 3 downvotes. — rockstardev, Sep 02 '13 at 10:59

score 4 · Accepted Answer · answered Mar 10 '13 at 18:01

Yes, it is still necessary. json_encode adds backslashes to the strings contained within the JSON, but not to the control elements of the JSON itself.

So, this:

array( 'key' => 'some "value" here' );

Becomes:

{"key": "some \"value\" here"}

There are still quotes in the string that are not escaped (the quotes surrounding the keys and values. json_encode is not meant to protect against SQL injection. It adds slashes purely for the JSON, so that when you, later on, json_decode() the data, it knows where the strings start and stop.

As others have said - use prepared statements. Period. If you're already using mysqli you have no reason not to.

score 2 · Answer 2 · answered Mar 10 '13 at 18:02

2

If you are using mysqli, just use Prepared Statements and you're done.

answered Mar 10 '13 at 18:02

Can Geliş

1,454
2
10
19

Prepare statement arent 100% safe Still need sanitization – Damian Chudobiński Sep 21 '22 at 19:15

Your Common Sense · Answer 3 · 2013-03-10T18:14:13.443

2

Neither json_encode() nor mysqli_real_escape_string() does protect against SQL injection.

Moreover, if you wouldn't use mysqli_real_escape_string() in your json encoded values, you'll be unable to decode them back.

Also, if you're storing json in your database, your database structure is wrong.

Tables you're using you your databases are such arrays. They are intended to store scalar values in their cells.

edited Mar 10 '13 at 18:14

answered Mar 10 '13 at 18:05

Your Common Sense

156,878
40
214
345

score 1 · Answer 4 · edited May 23 '17 at 12:31

1

json_encode is insufficient protection against XSS or the generation of SQL errors. The act of encoding an object as JSON will even add new quote characters.

… but don't use mysqli_real_escape_string, use prepared statements and parameterized queries.

… and generally you shouldn't be storing JSON in a database. Normalise your data so you can query it.

edited May 23 '17 at 12:31

Community

1
1

answered Mar 10 '13 at 18:02

Quentin

914,110
126
1,211
1,335

Does json_encode() protect against SQL injections?

4 Answers4