is this the proper use of mysql_real_escape_string() to prevent sql injections?

Posted on 16th Feb 2014 07:03 pm by admin

i was wondering is this the proper use of mysql_real_escape_string() to prevent sql injections? any help greatly appreciated. thanks. derek

Code: <?php
include("connect1.php");

session_start(); // this is the session declaration , one per page.

$u = trim($_POST['username']);
$p = trim($_POST['password']);

$logoff = $_GET['logoff'];
$hack = $_GET['hack'];





if($logoff){


unset($_SESSION['userid']);

//session_destroy(); //commented out gets rid of the having to login twice.

$message = "You have been logged off";




}


if($hack){

$message = "Naughty Naughty!"; // COOL

}


// escape username and password for use in SQL
$u = mysql_real_escape_string($u);
$p = mysql_real_escape_string($p);


// if fields username and password have contents, then...
if($u && $p){

$query = mysql_query("SELECT * FROM table2 WHERE username = '$u' AND password = '$p'");

$result = mysql_fetch_array($query); //creates array called result,//notice we dont need a while loop here.

if($result['username']){

$message = "You have been logged in";

$_SESSION['userid'] = $result['username'];

header("Location:old.mainsite.php");
exit;


}else{

$message = "You do not exist on the system";

}



}
?>

Your Answer:

Login to answer

Other forums

Month String to Numeric?
Hi guys,

Given a month as a string, is there a simple way to find the numeric representation

mysql select query problem
how can i select multiple fields from multiple table in one query like

i have table name t1 a

SCO Unix
I know this might not be the place to ask, but, can anyone tell me if SCO Unix comes with PHP built

quotes changing
hi all

in my content

opening quotes " changes to “

close qu

read integers that returns a negative or prints the average
Im trying to finish this homework assignment by tommarow afternoon and I keep getting stuck.
Wr

mail() problem
Hi Guys,

I've set up a contact email form. It sends the information fine, but it sends it to

Running External Scripts
I am very new to PHP and am not even sure what I'm asking is possible. I have just installed mediaW

Shopping Cart
Can anyone direct me to a Simple, Basic structure of a shopping cart.
New to classes. I want to s

How would I do "Users not logged in since *** delete them"
I know how I would set this up, and delete the user roughly.
I'll create a table called "Use

Which PHP-Editor do you think is the best?
Hi everyone,
Myself Brian Anderson. For the last 2 years i have been working a