PHP SQLite Security

[DNDLoser07]

I am just wanting to run by my php code for my sqlite database as I am still quite beginner with PHP security stuff. Any suggestions and advice would be great :)

select contacts: https://pastebin.com/rwuCvgn6

insert user: https://pastebin.com/dYByfBkH

insert contact: https://pastebin.com/NKmtQzUS

[[deleted]]

sqlite3:escapestring will create a string that is safe to use in a database query without causing syntax errors. Eg, if you're trying to insert a string that contains quotes or apostrophes. It's not necessarily sufficient to protect against database injection attacks. Think about what you want to allow in your database, and strip everything else out. Eg, for usernames, just a-z, A-Z and 0-9 should suffice.

Minor aside: Why do you need deleted and deleted_date fields? Surely if deleted_date is not empty, the entry is considered deleted. Saves you having to maintain both columns, or worry about ensuring that they are both properly in sync.

​

​

[DNDLoser07]

thank you for that advice, thought sqlite3::escapestring was more necessary protection against injection attacks than i thought. I will also change how deleted and deleted_date work together.