K
K
kurtov2016-07-26 17:17:27
PHP
kurtov, 2016-07-26 17:17:27

Is sql injection possible when inserting string json_encode($array, JSON_UNESCAPED_UNICODE)?

I receive data from the client and form an array. I store the array in the mysql database in the TEXT field. Insert or update with a regular string:

$string =  json_encode($array,  JSON_UNESCAPED_UNICODE);
$query = "UPDATE db_table SET db_field='$string'";

How it is possible to carry out SQL injection in this case?
The search gave only the conclusion that it is unsafe and it is not necessary to do so. But I did not find real examples.
I would like to secure the database from injections, but do not want to:
1. use prepared queries, because extra requests;
2. escape the entire json string using mysqli_real_escape_string;
3. normalize the database or use another database (MongoDB) because at this stage of development it is not necessary

Answer the question

In order to leave comments, you need to log in

3 answer(s)
M
Max, 2016-07-26
@kurtov

https://3v4l.org/9kK8W

X
xmoonlight, 2016-07-26
@xmoonlight

Clear $array with regex of all UNEXPECTED values ​​and then check that all required values ​​(for further work with the base) are present.

T
trevoga_su, 2016-07-26
@trevoga_su

www.database.phpinfo.su

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question