注释字段中的sql注入

Question

I have a comment form that consists of 2 fields (title and comment). Database contains 3 columns id, title and comment. Comment is displayed based on it's title like domain.com/index.php?id=sometitle

The title field is properly secured for sql injection using mysql_real_escape_string, but comment field which is a textarea is left open without escaping. I can escape it, however i'm wondering what harm can it do to just leave it without using mysql_real_escape_string on that field knowing that title is already escaped and it's how the output is retrieved.

Answer 1

What would happen if someone typed this into your textarea.

some comment');DELETE FROM COMMENTS;--

If your query to insert the comment were something like

INSERT INTO Comments(Title,Comment) VALUES('$title','$comments');

then you would have a problem. the resulting query would be

 INSERT INTO Comments(Title,Comment) VALUES('some title','some comment');DELETE FROM COMMENTS;--'

or to lay it out in a more readable format

INSERT INTO Comments(Title,Comment) VALUES('some title','some comment');
DELETE FROM COMMENTS;--'

the --' at the end just creates a comment, to get rid of any extra SQL that would make it not parse properly.