Will this protect from mysql injection?


Posted on 16th Feb 2014 07:03 pm by admin

I do not want anything like DROP TABLE to work or any type of coding..

Heres my code.. is it secure? if not, please help:

Did you know?Explore Trending and Topic pages for more stories like this.
Code: <?php
mysql_connect('','','');
mysql_select_db('cars');

if(preg_match("/^[ a-zA-Z 0-9 &]+/", $_POST['q'])){

$q = $_POST['q'];

$q = addslashes(mysql_real_escape_string($q));

$result = mysql_query("SELECT * FROM parts WHERE MATCH (`category`,`name`,`description`) AGAINST ('$q' IN BOOLEAN MODE)");

$num_results = mysql_num_rows($result);

echo 'Found '.$num_results.' parts matching '.$q.'.';

if($num_results>0) {

$row['name'] = stripslashes(stripslashes($row['name']));
$row['description'] = stripslashes(stripslashes($row['description']));

echo '<p>'.$row['name'].'</a>
<img src="'.$row['thumbnailurl'].'"><br />'.$row['description'].'<br />'.$row['date'].'</p>';
}
}
else {
echo '<p>Their were 0 results for '.$q.'! Try again?</p>';
}
}
else {
echo '<p>TEXT ONLY PLEASE</p>';
}
?>
No comments posted yet

Your Answer:

Login to answer
146 Like 39 Dislike
Previous forums Next forums
Other forums

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result
what is wrong with this

Code: [Select]<?php
if ($_SERVER['HTTP_REFERER'])
{

private constructor
Hello,

Can we create a constructor as private? If yes, what is the use of it? If no, why can'

How to assign JS screen.width to ASP.Net variable
I've got this ASP.net routine that gets the cookie value of the screen width, but now I need to chan

get the country of visitor and display content based on that
Hello all,

I have seen that Google analytics can tell you where a visitor is coming from and

Streaming local file from PHP while it’s been written to by a CURL process
I am creating a simple Proxy server for my website. Why I am not using mod_proxy and mod_cache is a

Display search result
Hi!

I have a SQL database with information about albums and track (music).

This is wh

Using real time in php
I'm very average at PHP and im looking to introduce time to something on my site.
Its a sports si

email CODING Problem
Email coding problem.

I need to send a section of the info to $tf and the same as a Cc to $em

Auto-populating dropdowns and multiple forms.
Here's what I have so far:

First drop down = select a state (works)
This populates the sec

Why is the logic of this simple code not working?
Hey, I'm trying to determine if a table already exists in mysql, but doing a query first with mysql_

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash