How To Sanitize Input With Php And The Sqlsrv Driver?

I'm working on a PHP MSSQL project that is using the sqlsrv driver. What's the best way to stop SQL injection attacks? I need something like mysql_real_escape_string() but for sqls

Solution 1:

If you use it like this, quoting is automatic:

$sql = "exec usp_cis_upd
        @key = ?,
        @value = ?";

$params = array(
    $key,
    trim($_POST["value"]));

$stmt = sqlsrv_query($dbh, $sql, $params);

Solution 2:

The best way is not to write your SQL so that you need to use an analogue of mysql_real_escape_string(), which you would do by using placeholders for the values and then passing the variables (that would otherwise have been handled by mysql_real_escape_string()) when you execute the statement or open the cursor or whatever.

Failing that, look at the output of mysql_real_escape_string(); it might be appropriate for MS SQL Server too. It depends on how it does the escaping (and what escaping it does).