0

I'm in a situation where I can't mix named and positional parameters in my PDO prepared statement. It's a long story but to simplify I decided to just ditch prepared statements when using IN operator.

E.g., use plain WHERE column IN (1, 2, 3) instead of WHERE column IN (?, ?, ?).

To ensure data is still safe, can I just use mysqli_escape_string() instead?

E.g.,WHERE column IN ('.mysqli_escape_string($a).', '.mysqli_escape_string($b).', '.mysqli_escape_string($c).') ?

In a nutshell, I want to know if mysqli_escape_string() is a good replacement for prepared statement in my use case?

Edit: replaced mysql_* with mysqli_*

IMB
  • 15,163
  • 19
  • 82
  • 140
  • 3
    Since the `mysql_*` extension no longer exists ... I'd say definitely not. – CD001 May 22 '18 at 08:32
  • No, it is not good. – delboy1978uk May 22 '18 at 08:32
  • 1
    Also [this](https://stackoverflow.com/questions/17498216/can-i-mix-mysql-apis-in-php), [this](https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string?rq=1) and [this](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – CD001 May 22 '18 at 08:32
  • 1
    It is not safe even if you were to use `mysqli_real_escape_string($link, $thing)` – RiggsFolly May 22 '18 at 08:32
  • @CD001 Thanks for pointing that out. I have replaced the question with `mysqli_` – IMB May 22 '18 at 08:35
  • Are you actually using integers in your query? Use `intval`, I'm pretty sure SQL injection isn't getting around that. – iainn May 22 '18 at 08:37
  • This is for a wrapper function for PDO so it is not always integers – IMB May 22 '18 at 08:38
  • 1
    *"This is for a wrapper function for PDO..."* - which rather begs the question as to why you're abstracting an abstraction class..? – CD001 May 22 '18 at 08:39
  • If wrapping PDO will mean that you lose the ability to use prepared statements then don't do it. – apokryfos May 22 '18 at 08:43
  • @CD001 Ok here's the "long story": I made a query builder class long ago that used PDO name parameters in the prepared statements. Now I needed to use `IN` statements and realize I couldn't mix named and positional params together. 100% of the query builder used named params, unfortunately it appears I can't use named params in `IN` statements, only positional params. It's clashing together so I must ditch positional params. – IMB May 22 '18 at 08:44
  • 1
    Can you design your query builder to create a series of named parameter placeholders like `:inparam1`, `:inparam2`, `:inparam3`, ... – Bill Karwin May 22 '18 at 21:19

0 Answers0