Is sprintf() safe enough to rely on?

[maurits]

Hello everyone!

After reading the sticky posts in this forum about security, I'd like to know if the following would be a secure way to get information from a database:

Code: Select all

function getCompanionInfo($id,&$returnArray){

	global $dbConnection;
	
	if(is_integer($id)){
		$query = sprintf("SELECT * FROM companions WHERE companion_id = %d LIMIT 1",$id);
		$result = mysql_query($query,$dbConnection);
		$returnArray = mysql_fetch_array($result);
		return $returnArray;
	} else {
		die("This script is protected against SQL injection.");
	}
}

Any thoughts would be greatly appreciated!

Kind regards,
Maurits

[AeroX]

I realise that this is a several year old thread but it saves be creating my own on a simular topic.

The basic rules of how to write more secure SQL:

• All table and coloum names sould be enclosed between two of these `.
• All data you are providing sould be enclosed between two of these '.
• Conditional sections of the sql sould be in brackets ().
• SQL functions(?) sould be in uppercase.
• SQL querys sould end with a semi-colon (;).

Example:

Code: Select all

SELECT * FROM `companions` WHERE (`companion_id`='%d') LIMIT 1;