SQL Injection with PHP + Sqlserver

Question

How can I prevent SQL Injection from input via POST using PHP + Sqlserver. (Using Microsoft SQL Server => mmsql)

I’m doing the data abstraction of a comic that runs MYSQLI and in this case is done this way.

$Email= mysqli_real_escape_string($conexao, $_POST['Email']);
$Senha= mysqli_real_escape_string($conexao, $_POST['Senha']); 
 

Answer 1

There are two drivers to connect SQL Server to PDO and SQLSRV, There are several questions about the specific PDO for SQL Server, since the instation and configuration, creation of the connection and the other aspects of the library.

Making the connection:

$servidor = 'ip ou servidor\instancia';
$db = 'test';
$usuario = 'user';
$senha = 'pass';        

$conexao = sqlsrv_connect($servidor, array('Database' => $db, 'UID' => $usuario, 'PWD' => $senha));

Escaping characters does not prevent or resolve the sql injections problem as shown that answer, the best way to tackle this problem is to filter user inputs properly and use Prepared statements.

For DML(Insert, update or delete) do this code, this is just an example please do not store passwords in plain text format in the database.

$sql = "INSERT INTO usuarios(email, nome, senha) VALUES(?,?,?)";

$email = "[email protected]";
$nome = "Doge";
$senha = "wowsuchsecret";

$stmt = sqlsrv_prepare( $conexao, $sql, array($email, $nome, $senha));
if( !$stmt ) {
    die( print_r(sqlsrv_errors());
}

Select:

$sql = "SELECT * FROM usuarios";
$stmt = sqlsrv_query($conexao, $sql);
if( $stmt === false) {
    die(print_r(sqlsrv_errors()));
}

while( $row = sqlsrv_fetch_array( $stmt, SQLSRV_FETCH_ASSOC) ) {
      echo $row['nome']." - ".$row['email']."<br />";
}