title: GET parameters vulnerable to SQL Injection - PHP
body: <p>I've been asked to handle a security issue for a site which was set up by another programmer. As of yet, I haven't seen any of the code, so I'm going off of assumptions at this point and I want to cover my bases. The group hosting the site ran a security check and found that they had code vulnerable to SQL injection. </p>
  
  <p>Example: www.example.com/code.php?pid=2&amp;ID=35 (GET parameter ID is vulnerable to SQL Injection)</p>
  
  <p>Now, because I'm a novice, I've explained that I can likely resolve the issue with the host, but their site would still need to be looked over by someone who has a deeper knowledge of security.</p>
  
  <p>So, to take care of potential SQL Injections (and without seeing the code), I would use mysql_real_escape_string:</p>
  
  <pre><code>$query = sprintf("SELECT * FROM table WHERE pid='%s' AND ID='%s'",
              mysql_real_escape_string($pid),
              mysql_real_escape_string($id));
  </code></pre>
  
  <p>Additionally, I would consider mysqli_real_escape_string and prepared statements, but I don't know how they're configured. But would mysql_real_escape_string take care of potential SQL Injection?</p>