空和isset检查中的sql注入漏洞

Question

i am currently working on making my site injection proof and was wondering about the validations i am making, my code goes like this:

if(!empty($_POST['city']) && !empty($_POST['street'])){
  $city = htmlentities(mysql_real_escape_string($_POST['city']));
  $street = htmlentities(mysql_real_escape_string($_POST['street']));   
}

my question is isnt the empty check itself is a vulnerability? i mean do i have to escape string in the !empty validation as well? or it is safe to keep it that way? thanks.

Answer 1

For SQL injection you only need to worry when quering the database, so isset is safe.

There should be no need for htmlentities (use it as protection against XSS).

mysql_real_escape_string will protect against SQL injection if done correctly, but should not be used at all, since the mysql_ prefix / DB-handler is outdated, deprecated and should not be used at all. The safest way is to use either mysqli_ or PDO, and use prepared statements.