is this the proper use of mysql_real_escape_string() to prevent sql injections?

Posted on 16th Feb 2014 07:03 pm by admin

i was wondering is this the proper use of mysql_real_escape_string() to prevent sql injections? any help greatly appreciated. thanks. derek

Code: <?php
include("connect1.php");

session_start(); // this is the session declaration , one per page.

$u = trim($_POST['username']);
$p = trim($_POST['password']);

$logoff = $_GET['logoff'];
$hack = $_GET['hack'];





if($logoff){


unset($_SESSION['userid']);

//session_destroy(); //commented out gets rid of the having to login twice.

$message = "You have been logged off";




}


if($hack){

$message = "Naughty Naughty!"; // COOL

}


// escape username and password for use in SQL
$u = mysql_real_escape_string($u);
$p = mysql_real_escape_string($p);


// if fields username and password have contents, then...
if($u && $p){

$query = mysql_query("SELECT * FROM table2 WHERE username = '$u' AND password = '$p'");

$result = mysql_fetch_array($query); //creates array called result,//notice we dont need a while loop here.

if($result['username']){

$message = "You have been logged in";

$_SESSION['userid'] = $result['username'];

header("Location:old.mainsite.php");
exit;


}else{

$message = "You do not exist on the system";

}



}
?>

Your Answer:

Login to answer

Other forums

Help on query replacing the date
Hi Pals,

i want to replace the current date in a column to some value say C or D or any n

Getting Subdomain Name With PHP?
I want to grab the subdomain name with PHP so I can generate database queries.

for example my

Data Function is Its Not working IN IE8
This is my first time to use formums. I hope i can get solution for this problem. view plaincopy to

why this query can delete duplicates ?
why this query can delete duplicates ? Anybody can give me the detailed explanation ?

Tha

Google voice
I currently have a form in html, but I want it in php so the information is not in the source code.<

Module pool selction screen parameters combination logic
Hi floks,
Am new to the module pool development ,Recently i have created one program based on

Turning Data into URLs?
This may seem very basic to you, but I'm having a hard time figuring out how to do this since I don'

File upload issues
Hi Guys,

Can anyone see any issues with this code:
Code: $setImage= 'productimages/' . dat

str_replace help
I am thinking str_replace is my only option to filter outputs from my database to convert them to sa

Secure pages Sessions vs. Cookies & session_destroy() help
Im new here and new to PHP, I hope you can help me with some questions.

Im writing my web ap