is this the proper use of mysql_real_escape_string() to prevent sql injections?


Posted on 16th Feb 2014 07:03 pm by admin

i was wondering is this the proper use of mysql_real_escape_string() to prevent sql injections? any help greatly appreciated. thanks. derek

Code: <?php
include("connect1.php");
Did you know?Explore Trending and Topic pages for more stories like this.

session_start(); // this is the session declaration , one per page.

$u = trim($_POST['username']);
$p = trim($_POST['password']);

$logoff = $_GET['logoff'];
$hack = $_GET['hack'];





if($logoff){


unset($_SESSION['userid']);

//session_destroy(); //commented out gets rid of the having to login twice.

$message = "You have been logged off";




}


if($hack){

$message = "Naughty Naughty!"; // COOL

}


// escape username and password for use in SQL
$u = mysql_real_escape_string($u);
$p = mysql_real_escape_string($p);


// if fields username and password have contents, then...
if($u && $p){

$query = mysql_query("SELECT * FROM table2 WHERE username = '$u' AND password = '$p'");

$result = mysql_fetch_array($query); //creates array called result,//notice we dont need a while loop here.

if($result['username']){

$message = "You have been logged in";

$_SESSION['userid'] = $result['username'];

header("Location:old.mainsite.php");
exit;


}else{

$message = "You do not exist on the system";

}



}
?>
No comments posted yet

Your Answer:

Login to answer
259 Like 53 Dislike
Previous forums Next forums
Other forums

Scrolling news bar and MySQL
I am not sure if this is the correct forum to post this on. If not, I apologize. I am still pretty

listcube issue
Hi
I have a virtual cube ZREMOTE. I use Tcode "listcube" to retrieve contents. I use of the

Calander layout
Hi i know this sounds like a simple question but i cant find the answer to it anywhere i have added

Checking if multidimensional array is empty?
I have a for with multiple test input fields. Specifically the user submits multiple names and ages

Forum tutorial
Im a beginner in PHP. Im making a forum(previous questbook, counter and few others) to learn. For no

How many users online in the last 24-hours using time()?
I'm fairly new to PHP. I have a MySQL table called 'users' and a field called 'loggedin' which is in

captcha error
I have been trying to implement a captcha in php...

here is the code..
Code: (php) [Select

Login script (probably a simple error)
dbConfig.php
Code: <?
// Replace the variable values below
// with your specific dat

php code generators
All

Whilst enjoying learning a new language i have come accross a number of free code generat

Data storage spaces in varchar2
Trying to understand what's happening.
I am selecting a value from a table that is defined as c

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash