Is sprintf() safe enough to rely on?

[maurits]

Hello everyone!

After reading the sticky posts in this forum about security, I'd like to know if the following would be a secure way to get information from a database:

Code: Select all

function getCompanionInfo($id,&$returnArray){

   global $dbConnection;
   
   if(is_integer($id)){
      $query = sprintf("SELECT * FROM companions WHERE companion_id = %d LIMIT 1",$id);
      $result = mysql_query($query,$dbConnection);
      $returnArray = mysql_fetch_array($result);
      return $returnArray;
   } else {
      die("This script is protected against SQL injection.");
   }
}


Any thoughts would be greatly appreciated!

Kind regards,
Maurits

[sneakersupplier]

Thanks,i like it!
website: Nike Air Force Ones

[AeroX]

I realise that this is a several year old thread but it saves be creating my own on a simular topic.

The basic rules of how to write more secure SQL:

• All table and coloum names sould be enclosed between two of these `.
• All data you are providing sould be enclosed between two of these '.
• Conditional sections of the sql sould be in brackets ().
• SQL functions(?) sould be in uppercase.
• SQL querys sould end with a semi-colon (;).

Example:

Code: Select all

SELECT * FROM `companions` WHERE (`companion_id`='%d') LIMIT 1;