Will this protect from mysql injection?

Posted on 16th Feb 2014 07:03 pm by admin

I do not want anything like DROP TABLE to work or any type of coding..

Heres my code.. is it secure? if not, please help:

Code: <?php
mysql_connect('','','');
mysql_select_db('cars');

if(preg_match("/^[ a-zA-Z 0-9 &]+/", $_POST['q'])){

$q = $_POST['q'];

$q = addslashes(mysql_real_escape_string($q));

$result = mysql_query("SELECT * FROM parts WHERE MATCH (`category`,`name`,`description`) AGAINST ('$q' IN BOOLEAN MODE)");

$num_results = mysql_num_rows($result);

echo 'Found '.$num_results.' parts matching '.$q.'.';

if($num_results>0) {

$row['name'] = stripslashes(stripslashes($row['name']));
$row['description'] = stripslashes(stripslashes($row['description']));

echo '<p>'.$row['name'].'</a>
<img src="'.$row['thumbnailurl'].'"><br />'.$row['description'].'<br />'.$row['date'].'</p>';
}
}
else {
echo '<p>Their were 0 results for '.$q.'! Try again?</p>';
}
}
else {
echo '<p>TEXT ONLY PLEASE</p>';
}
?>

Your Answer:

Login to answer

Other forums

Help on code output
My CODE:

Code: [Select] echo "<phone>".$line["phone"].&qu

retrieving policy name inside the function called by this particular policy
Hi there,

I've playing around with dbms_rls package, trying to set up some security repo

Set Categories
I am creating a submission form for somebody to come in and submit products. These products are sep

in php, link returns to the line
When I add a link in a php page, the link word returns to the line (as a
would do)

Examp

Problem with PHP code- simple contact form
Hi Folks,
I'm relativily new to PHP; I know HTML and CSS stuff but I have a problem- I have a co

How do I know when getBounds Method is ready to be called.
I have an application that changes out stylesheets client side. Once I change stylesheet the browse

php is not recognized as an internal or external command
Hello,

I am trying to bake the code in CakePHP through my console.
I have changed my Path

Multiple Options for a Single Page
For this example I want to use the Handlers option which is under Fed Admin and all the related codi

Supress some serveroutput but not all
Hi,

I have a script I'm working on that uses plsql to create and RMAN script, this uses d

pls clear my confusion
Hi friends,

Pls solve my query .

what is the exact use of Scope Resolution Operator( i