Base64 Encoded String For Simple Sql Injection

Except performance issue, is base64_encode() a 'good' practice to prevent SQL injection? Of course not for all fields (columns) but just for one TEXT field (Example: in a contact f

Solution 1:

Due the nature of base64_encode() function (make binary data survive transport through transport layers that are not 8-bit clean) you don't have to escape anything!

Characters returned are [0-9a-zA-Z/]

But I strongly suggest you to use prepared statement (with mysqli or PDO). Are a tiny bit slower but you will not change the sanitizing logic every time you deal with a table structure.

And also, not less important, maybe in the future you need to index the data on you table (Perhaps for search with LIKE or FULLSEARCH).

Your second example is correct (Bind ALL your parameters)

Solution 2:

The base64_encode function is not intended to escape strings, i.e. there is no warranty that a specific SQL dialect won't consider any base64-encoded character as a delimiter; you should always rely on dedicated escape functions. However we don't know any SQL dialect that would consider a base64 character as a delimiter, so it would be safe anyway.