PHP and MySQL

32.3    SQL Injection

As noted earlier, the code for entering guestbook entries still has a major shortcoming. The problem lies in the following instruction:

$db->query( "    INSERT INTO entries (entry) VALUES ('$entry')");  

As a reminder: The value of $entry is transferred via POST. So far, so good, but what happens if the entry contains an apostrophe, such as Shaquille O'Neal? Then the SQL command would look like this:

INSERT INTO entries (entry) VALUES ('Shaquille O'Neal')  

As you can easily see, the SQL command is invalid. But that's not so bad. What do you think of the following command?

INSERT INTO entries (entry) VALUES (''); DELETE FROM entries --')  

Here, an (empty) entry is inserted into the database and then the database content is deleted ...