Re: query checking - Mailing list pgsql-php

You can try using the ereg() or eregi() functions and check for what the user
inputed. For example:

if (eregi("delete", $query)
     {
     echo " you can not delete from table";
     }
elseif ( (eregi("select", $query) || (eregi("update", $query) ||
(eregi("insert", $query)  )
     {
     execute $query;.....
     }

Hope this helps.

Tim.




s <stefang@bundabergcity.qld.gov.au> on 01/21/2001 07:44:20 PM

To:   pgsql-php@postgresql.org
cc:    (bcc: Timothy Maguire/Data-Technologies/Harte-Hanks)

Subject:  query checking



I am writing a site that
does select/insert SQL commands with users input.

There is a potential hazard if some one tries to execute there
own commands in an input box
eg.    the user types into the input  box on a form  -   [ "; delete *
from table; ]

I'm after a regular expression (that'd be nice) or an algorithm to
tell that only one query is being passed to psql at a time.

The query string will be processed if
Either - one SELECT command only
           - one INSERT command only
           - one UPDATE command only
ELSE - dont process query

Any input would be much appreciated.
thanks,
stef