is this the proper use of mysql_real_escape_string() to prevent sql injections?


Posted on 16th Feb 2014 07:03 pm by admin

i was wondering is this the proper use of mysql_real_escape_string() to prevent sql injections? any help greatly appreciated. thanks. derek

Code: <?php
include("connect1.php");
Did you know?Explore Trending and Topic pages for more stories like this.

session_start(); // this is the session declaration , one per page.

$u = trim($_POST['username']);
$p = trim($_POST['password']);

$logoff = $_GET['logoff'];
$hack = $_GET['hack'];





if($logoff){


unset($_SESSION['userid']);

//session_destroy(); //commented out gets rid of the having to login twice.

$message = "You have been logged off";




}


if($hack){

$message = "Naughty Naughty!"; // COOL

}


// escape username and password for use in SQL
$u = mysql_real_escape_string($u);
$p = mysql_real_escape_string($p);


// if fields username and password have contents, then...
if($u && $p){

$query = mysql_query("SELECT * FROM table2 WHERE username = '$u' AND password = '$p'");

$result = mysql_fetch_array($query); //creates array called result,//notice we dont need a while loop here.

if($result['username']){

$message = "You have been logged in";

$_SESSION['userid'] = $result['username'];

header("Location:old.mainsite.php");
exit;


}else{

$message = "You do not exist on the system";

}



}
?>
No comments posted yet

Your Answer:

Login to answer
259 Like 53 Dislike
Previous forums Next forums
Other forums

What are causes of a connection-timeout with fopen()?
Hello! Here is the situation: The server I host my website on just upgraded it's PHP build from 4.4.

Require select-option functionality in Module Pool Programming
Hi Gurus,

I am doing a development by Module Pool on Warehouse Management. For that devel

Print 'a' to 'z' via for loop
A very simple problem..
How Can I print a to z NOT a to y ?
It is a part of a code where
<

Call db table from any PHP file
Hi,

I want to be able to call a database table that will be setup in another file called init

mySQL and PHP search
Hello,
I am trying to code a project and ran into a brick wall with one of my pages. I am pretty

void* and sizeof()
Hi,

Using void* and sizeof is it possible to get the value of the object ?

I understan

Alternate messaging
I have 4 strings in MySQL db1

$string1 : Hello
$string2 : Hi
$string3 : Great
$strin

True way to see if action was successful?
If this is a good way to see if action was successful to continue:

Code: function changeGa

Saas with SAP R/3
hi experts,

Is SaaS offer available in SAP? for SAP R/3? from where i can get the info a

Problem with a select distinct
I have a problema with a select distinct, I have the next sql:

select distinct a,b,c,d fr

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash