Write Forums

is this the proper use of mysql_real_escape_string() to prevent sql injections?

Posted on 16th Feb 2014 07:03 pm by admin

i was wondering is this the proper use of mysql_real_escape_string() to prevent sql injections? any help greatly appreciated. thanks. derek

Code: <?php
include("connect1.php");

session_start(); // this is the session declaration , one per page.

$u = trim($_POST['username']);
$p = trim($_POST['password']);

$logoff = $_GET['logoff'];
$hack = $_GET['hack'];





if($logoff){


unset($_SESSION['userid']);

//session_destroy(); //commented out gets rid of the having to login twice.

$message = "You have been logged off";




}


if($hack){

$message = "Naughty Naughty!"; // COOL

}


// escape username and password for use in SQL
$u = mysql_real_escape_string($u);
$p = mysql_real_escape_string($p);


// if fields username and password have contents, then...
if($u && $p){

$query = mysql_query("SELECT * FROM table2 WHERE username = '$u' AND password = '$p'");

$result = mysql_fetch_array($query); //creates array called result,//notice we dont need a while loop here.

if($result['username']){

$message = "You have been logged in";

$_SESSION['userid'] = $result['username'];

header("Location:old.mainsite.php");
exit;


}else{

$message = "You do not exist on the system";

}



}
?>

No comments posted yet

259 53 Tweet

 formating when pulling data from a mysql database 
Ok so Im not to sure if this is the right thread to post in but here is my catch 22 issue.

I 
retrieving images from mysql database using php 
So I've been trying to figure out how to store images in a mysql database, and as far as i can tell 
upload image name with extension using php 
hi frds..

<input id="file1" type="file" name="file[]" &a
SELECT * FROM users WHERE Users are not in Blocked 
How do I select all users from users table where there users_id is not stored in the block table
urldecode question 
How would I format this line of code properly?

<?php echo urldecode($_GET['Title']); ?
Using Windows message as a Handle  
Hi,



I am writing one of my first multithreaded programs.



In one of the thread,
foreach loop, assistance request 
I would like some guidance on the usage of foreach as I try to parse through a large database and wh