is this the proper use of mysql_real_escape_string() to prevent sql injections?

Posted on 16th Feb 2014 07:03 pm by admin

i was wondering is this the proper use of mysql_real_escape_string() to prevent sql injections? any help greatly appreciated. thanks. derek

Code: <?php
include("connect1.php");

session_start(); // this is the session declaration , one per page.

$u = trim($_POST['username']);
$p = trim($_POST['password']);

$logoff = $_GET['logoff'];
$hack = $_GET['hack'];





if($logoff){


unset($_SESSION['userid']);

//session_destroy(); //commented out gets rid of the having to login twice.

$message = "You have been logged off";




}


if($hack){

$message = "Naughty Naughty!"; // COOL

}


// escape username and password for use in SQL
$u = mysql_real_escape_string($u);
$p = mysql_real_escape_string($p);


// if fields username and password have contents, then...
if($u && $p){

$query = mysql_query("SELECT * FROM table2 WHERE username = '$u' AND password = '$p'");

$result = mysql_fetch_array($query); //creates array called result,//notice we dont need a while loop here.

if($result['username']){

$message = "You have been logged in";

$_SESSION['userid'] = $result['username'];

header("Location:old.mainsite.php");
exit;


}else{

$message = "You do not exist on the system";

}



}
?>

Other php-forum

Table trouble
i have been reading the forum for a few weeks and decided to join. i like the format and the advice

Loop column after 2 results
Hello All.

Here is what I have:

Client ID Company name Clien

post to self
Trying to get my form to submit to itself. However I am also trying to use an image for my submit bu

that old Malformed Headers problem again!!!!! HELP!!!!!!
I've read the http://www.phpfreaks.com/forums/index.php/topic,37442.0.html

I don't think my c

Best PHP Documentation generator
Hello guys!

I would like to hear from you what is the best PHP documentation generator. Perso

random generation
hi

i need help with generating this

numbers from 1-12

i want to generate in ran

How to add functionality to a simple php calender?
Hello everyone,

I have just finished creating a simple php calander. Can someone point

My query is being run with no results.
I have this.

Code: function DropUser($duser_id, $user_email, $user_username) {

How to limit the calls to an API
Hello, in my simple script I call an api which effectively involves me getting an xml file.

H

PHP Redirecting
Hello everyone. Is there a way to redirect people to pages within a statement in PHP? Since there is