How To Escape A NSString To Prevent SQLInjection With Core Data

what is the best way to escape a Search String from an input field to prevent SQLInjections? Is there an mysql_real_escape_string method like in PHP or should i manually replace/es

Solution 1:

closed with the answer from: @Nick Weaver:

I don't think that you have to take care about that.

Solution 2:

Using mysql_real_escape_string for a search query is a good option. However you need to be aware of 2 things :

1) If you apply this solution in an other situation, make sure the parameter is always quoted when it gets integrated. In short, mysql_real_escape_string does not protect you against numeric parameters. Here are 2 examples :

$bad_sql = "SELECT * FROM some_table WHERE id=" . mysql_real_escape_string($_GET['id']);

$good_sql  = "SELECT * FROM some_table WHERE name='" . mysql_real_escape_string($_GET['id']) . "'";

2) The second thing to consider is that mysql_real_escape_string does not escape wildcard characters (% and _). You should not worry about that. However, a "perfect" solution escape those characters.

For more information you can take a look at http://www.sqlinjection.net.

FYI : The official mysql_real_escape_string reference http://php.net/manual/en/function.mysql-real-escape-string.php.