<p>When you execute a SQL query, you have to clean your strings or users can execute malicious SQL on your website.</p>

<p>I usually just have a function escape_string(blah), which:</p>

<ul>
<li>Replaces escapes (<code>\</code>) with double escapes (<code>\\</code>).</li>
<li>Replaces single quotes (<code>'</code>) with an escaped single quote (<code>\'</code>). </li>
</ul>

<p>Is this adequate? Is there a hole in my code? Is there a library which can do this quickly and reliably for me?</p>

<p>I'd like to see graceful solutions in Perl, Java, and PHP.</p>

[{'answer_id': 2690, 'author': 'Mark Biek', 'author_id': 305, 'author_profile': 'https://Stackoverflow.com/users/305', 'pm_score': 0, 'selected': False, 'text': '<p>Which language you are using?  It seems like pretty much all of them have built-in SQL escape functions that would be better to use.</p>\n<p>For example, PHP has <a href="http://us2.php.net/manual/en/function.mysql-real-escape-string.php" rel="nofollow noreferrer">mysql_real_escape_string</a> and <a href="http://us2.php.net/manual/en/function.addslashes.php" rel="nofollow noreferrer">addslashes</a>.</p>\n'}, {'answer_id': 2691, 'author': 'GateKiller', 'author_id': 383, 'author_profile': 'https://Stackoverflow.com/users/383', 'pm_score': 2, 'selected': False, 'text': '<p>I would also escape comments (double dash)</p>\n\n<pre><code>--\n</code></pre>\n'}, {'answer_id': 2693, 'author': 'Karl Seguin', 'author_id': 34, 'author_profile': 'https://Stackoverflow.com/users/34', 'pm_score': 0, 'selected': False, 'text': "<p>You're better off using prepared statements with placeholders. Are you using PHP, .NET...either way, prepared statements will provide more security, but I could provide a sample.</p>\n"}, {'answer_id': 2696, 'author': 'Bob', 'author_id': 45, 'author_profile': 'https://Stackoverflow.com/users/45', 'pm_score': -1, 'selected': False, 'text': "<p>I am not sure if MySQL supports parameterized queries, if so, you should make an effort to go this route. This will ensure the users input can't do anything malicious.</p>\n<p>Otherwise some &quot;bad&quot; characters in addition to what you mentioned would be semicolon (;) and comments (-- and /* */).</p>\n"}, {'answer_id': 2727, 'author': 'TiTi', 'author_id': 435, 'author_profile': 'https://Stackoverflow.com/users/435', 'pm_score': 0, 'selected': False, 'text': '<p>In PHP, I\'m using this one and I\'ll appreciate every comment about it :</p>\n\n<pre><code>function quote_smart($valeur) \n{ \n    if (get_magic_quotes_gpc()) \n        $valeur = stripslashes($valeur); \n\n    if (!is_numeric($valeur)) \n        $valeur = mysql_real_escape_string($valeur); \n\n    return $valeur; \n}\n\n\n$IdS = quote_smart($_POST[\'theID\']); \n$sql = " \nSELECT * FROM Students \nWHERE IdStudent={$IdS}; \n";\n</code></pre>\n\n<p>Needs one more verification if a field can be NULL :</p>\n\n<pre><code>$picture = NULL;\n$theidyouwant = 7;\n$Name = \'WOOD\';\n\n\nif(is_null($picture)) \n    $p = \'NULL\'; \nelse\n    $p = "\'".quote_smart($picture)."\'"; \n\n$IdS = quote_smart($theidyouwant);\n\n$requete = "SELECT * FROM Students\n    WHERE IdStudent={$IdS} AND\n    PictureStudent={$p} AND\n    NameStudent=\'{$Name}\';\n    ";\n</code></pre>\n\n<p>That\'s it enjoy !\n(hope the post will correctly send underscores and not &amp;#95 ;)</p>\n'}, {'answer_id': 2734, 'author': 'cmcculloh', 'author_id': 58, 'author_profile': 'https://Stackoverflow.com/users/58', 'pm_score': 1, 'selected': False, 'text': '<p>A great thing to use in PHP is the <a href="http://us2.php.net/pdo" rel="nofollow noreferrer">PDO</a>. It takes a lot of the guesswork out of dealing with securing your SQL (and all of your SQL stuff in general). It supports prepared statements, which go a long way towards thwarting SQL Injection Attacks.</p>\n\n<p>A great primer on PDO is included in the book <a href="https://rads.stackoverflow.com/amzn/click/com/0975841998" rel="nofollow noreferrer" rel="nofollow noreferrer">The PHP Anthology 101 Essential Tips, Tricks &amp; Hacks by Davey Shafik etc. 2nd Ed</a>. Makes learning a breeze and is excellent as a reference. I don\'t even have to think about anything other than the actual SQL Query anymore.</p>\n'}, {'answer_id': 2741, 'author': 'Mark Harrison', 'author_id': 116, 'author_profile': 'https://Stackoverflow.com/users/116', 'pm_score': 4, 'selected': True, 'text': '<p>For maximum security, performance, and correctness use prepared statements.\nHere\'s how to do this with lots of examples in different languages, including PHP:</p>\n\n<p><a href="https://stackoverflow.com/questions/1973/what-is-the-best-way-to-avoid-sql-injection-attacks">https://stackoverflow.com/questions/1973/what-is-the-best-way-to-avoid-sql-injection-attacks</a></p>\n'}, {'answer_id': 2752, 'author': 'Steve T', 'author_id': 415, 'author_profile': 'https://Stackoverflow.com/users/415', 'pm_score': 0, 'selected': False, 'text': '<p>Use Prepared/Parameterized queries!</p>\n'}, {'answer_id': 11419, 'author': 'BCS', 'author_id': 1343, 'author_profile': 'https://Stackoverflow.com/users/1343', 'pm_score': 0, 'selected': False, 'text': "<p>the MySQL C API has it's own <code>mysql_escape_string()</code>. Using it or it's equivalent would be best.</p>\n"}, {'answer_id': 77190, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 0, 'selected': False, 'text': '<p>Use prepared statements.</p>\n'}, {'answer_id': 200052, 'author': 'AquilaX', 'author_id': 17734, 'author_profile': 'https://Stackoverflow.com/users/17734', 'pm_score': 0, 'selected': False, 'text': '<p>In MySQL query, when using LIKE, also make sure to escape the "_" characters as it is not escaped by mysql_real_escape_string.</p>\n\n<p>For reference, check <a href="http://dev.mysql.com/doc/refman/5.0/en/pattern-matching.html" rel="nofollow noreferrer">here</a> </p>\n'}]
['https://Stackoverflow.com/questions/2688', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/432/']