Would it be possible to prevent mysql injection using the gzcompress (and after retrieving it from the database, the gzuncompress) function? Or is there a reason why this would not work? Or is there a reason that this would not be a good idea at all?
-
AFAIK, the best way to prevent sql injection is to use command arguments instead of concatenation.– DmitryMay 1, 2011 at 7:35
3 Answers
This is a bad idea because
Theoretically, there might be a sequence of data that, when compressed, leads to a SQL injection or simply breaks the query
gzcompressed data can't be properly indexed and searched - you'll have a database full of garbled characters
gzcompression is computationally expensive
simply always sanitize your data before entering it into a database, using the string escaping method of your library (like mysql(i)_real_escape_string()) or parametrized queries.
If you do that reliably, no further protection is necessary.
-
3While the chance of compressed data leading to SQL injection is so low as to be virtually non-existent, there's the better chance that it'll simply break your SQL syntax. So you're back to escaping or binding values anyway. +1– deceze ♦May 1, 2011 at 7:38
SQL injection can be prevented 1 of 2 ways. You can use parameterized queries or you can properly sanitize values when building your SQL statements.
Now, what you are suggesting will probably prevent malicious injections into the database, but that does not eliminate the possibility that will introduce SQL syntax errors (effectively SQL injection) into your SQL statements.
Also, by using compression functions, it will eliminate the possibility of viewing or searching the contents of the database without going through decompression.
This is a novel approach to avoiding SQL injection, but will cause you more problems than it actually solves. You really need to stick with the tried and true solutions.