is this the proper use of mysql_real_escape_string() to prevent sql injections?

Posted on 16th Feb 2014 07:03 pm by admin

i was wondering is this the proper use of mysql_real_escape_string() to prevent sql injections? any help greatly appreciated. thanks. derek

Code: <?php
include("connect1.php");

session_start(); // this is the session declaration , one per page.

$u = trim($_POST['username']);
$p = trim($_POST['password']);

$logoff = $_GET['logoff'];
$hack = $_GET['hack'];





if($logoff){


unset($_SESSION['userid']);

//session_destroy(); //commented out gets rid of the having to login twice.

$message = "You have been logged off";




}


if($hack){

$message = "Naughty Naughty!"; // COOL

}


// escape username and password for use in SQL
$u = mysql_real_escape_string($u);
$p = mysql_real_escape_string($p);


// if fields username and password have contents, then...
if($u && $p){

$query = mysql_query("SELECT * FROM table2 WHERE username = '$u' AND password = '$p'");

$result = mysql_fetch_array($query); //creates array called result,//notice we dont need a while loop here.

if($result['username']){

$message = "You have been logged in";

$_SESSION['userid'] = $result['username'];

header("Location:old.mainsite.php");
exit;


}else{

$message = "You do not exist on the system";

}



}
?>

Your Answer:

Login to answer

Other forums

Showing selected item at top of list
Hi,

I've got a list of names which i am fetching from database like this:
$qry = db_query

List/Menu Box
On an edit page when you want something to select what a user has previously selected from the datab

single page with referrer to show correct page
I have a simple website with a couple of different pages. I would like to be able to in a div tag w

question about header() security
is is safe to just use the header() function to redirect someone if they are, say, not logged in? or

Count Session and Trigger Events
I am New in PHP, seeking a method to count logged users by counting the sessions or any …, is

Display data returned from Ajaxservices!!
I have a question about displaying results using ajax. I have part of the code below.
$.ajax({

Accessing Infotype data in dialog program
Hi All
In Dialog programs attributes I didn't see any logical database field. How can I access

PHP Array quick help
I need

$_SESSION{'username'} to be like this:


if $_SESSION['username'] = "gay

PHP Login
Hey!
I got this shopcart code online, am trying to modify it but am getting an error when i try a

split string
Hi all

i have some names (imploded by comma):
Code: toronto,paris,madrid
Now, i would