1

New! Save questions or answers and organize your favorite content.
Learn more.

Would it be possible to prevent mysql injection using the gzcompress (and after retrieving it from the database, the gzuncompress) function? Or is there a reason why this would not work? Or is there a reason that this would not be a good idea at all?

1
  • AFAIK, the best way to prevent sql injection is to use command arguments instead of concatenation.
    – Dmitry
    May 1, 2011 at 7:35

3 Answers 3

3

This is a bad idea because

  • Theoretically, there might be a sequence of data that, when compressed, leads to a SQL injection or simply breaks the query

  • gzcompressed data can't be properly indexed and searched - you'll have a database full of garbled characters

  • gzcompression is computationally expensive

simply always sanitize your data before entering it into a database, using the string escaping method of your library (like mysql(i)_real_escape_string()) or parametrized queries.

If you do that reliably, no further protection is necessary.

1
  • 3
    While the chance of compressed data leading to SQL injection is so low as to be virtually non-existent, there's the better chance that it'll simply break your SQL syntax. So you're back to escaping or binding values anyway. +1
    – deceze
    May 1, 2011 at 7:38
1

to protect against SQL Injection attacks, use PDO's parameterized queries.

1

SQL injection can be prevented 1 of 2 ways. You can use parameterized queries or you can properly sanitize values when building your SQL statements.

Now, what you are suggesting will probably prevent malicious injections into the database, but that does not eliminate the possibility that will introduce SQL syntax errors (effectively SQL injection) into your SQL statements.

Also, by using compression functions, it will eliminate the possibility of viewing or searching the contents of the database without going through decompression.

This is a novel approach to avoiding SQL injection, but will cause you more problems than it actually solves. You really need to stick with the tried and true solutions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.