Can addslashes() Really Prevent SQL Injection Attacks?

Understanding SQL Injections through addslashes()

addslashes() is a PHP function commonly used to escape special characters in strings to prevent SQL injection attacks. However, despite its intentions, it can actually facilitate such attacks upon rare occasions.

Let's delve into an example:

Scenario: A user submits the input "' OR 1=1 -- -" into a text field.

addslashes() would convert the input to: "' OR 1=1 -- -", but if the database encoding happens to support multi-byte characters like Shift-JIS, the apostrophe would become interpreted as part of a multi-byte character, effectively undermining the intended escape.

Consequently, the modified SQL query would look like: "'%OR 1=1 -- -"

This altered query succeeds in executing the SQL injection attack because the apostrophe is no longer treated as an escape sequence but rather a part of a multi-byte character.

The above is the detailed content of Can addslashes() Really Prevent SQL Injection Attacks?. For more information, please follow other related articles on the PHP Chinese website!