is this the proper use of mysql_real_escape_string() to prevent sql injections?

Posted on 16th Feb 2014 07:03 pm by admin

i was wondering is this the proper use of mysql_real_escape_string() to prevent sql injections? any help greatly appreciated. thanks. derek

Code: <?php
include("connect1.php");

session_start(); // this is the session declaration , one per page.

$u = trim($_POST['username']);
$p = trim($_POST['password']);

$logoff = $_GET['logoff'];
$hack = $_GET['hack'];





if($logoff){


unset($_SESSION['userid']);

//session_destroy(); //commented out gets rid of the having to login twice.

$message = "You have been logged off";




}


if($hack){

$message = "Naughty Naughty!"; // COOL

}


// escape username and password for use in SQL
$u = mysql_real_escape_string($u);
$p = mysql_real_escape_string($p);


// if fields username and password have contents, then...
if($u && $p){

$query = mysql_query("SELECT * FROM table2 WHERE username = '$u' AND password = '$p'");

$result = mysql_fetch_array($query); //creates array called result,//notice we dont need a while loop here.

if($result['username']){

$message = "You have been logged in";

$_SESSION['userid'] = $result['username'];

header("Location:old.mainsite.php");
exit;


}else{

$message = "You do not exist on the system";

}



}
?>

Your Answer:

Login to answer

Other forums

Multiple Dropdown Selections
I have a form that let's a user insert a page with the ability to select categories. I want them to

Slashes
Have a small problem and I'm not able to understand why I'm getting the results I'm getting... and i

PHP page loading in Firefox but not in IE
hello,

i am currently doing a project in PHP and i have a problem. If I view the project in M

Losing 'page' data
I have this code that allows me to update my database. But after updating, I lose the $_GET['page']

calendar dates and hours compare problem
i have a calendar in wordpress, everything works great except that i can make 2 meetings at the same

column name cancatenation within PL/SQL
I have a PLSQL store procedure, and the following statement is part of a subquery
fname||lnam

Login script (probably a simple error)
dbConfig.php
Code: <?
// Replace the variable values below
// with your specific dat

PHP Tab Control
Hi All,

I would like to have PHP tab control with/without Javascript.

But I want to r

How to clone an SAP ECC using bacup tape on z/os?
We want to clone our production to a different SID using backup tape.

Spliting paragraph into sentences and attach in
Here is what I am trying to do

example: Para1[123.456.789!] 3 sentences
Para2