How can one properly escape SQL queries using mysql_real_escape_string?

Question

How can one properly escape SQL queries using mysql_real_escape_string?

There are single quotes being used in

$bio = "$user->description";

when inserting into the database like this;

<?
$sql = "insert into yyy (id, twitterid, twitterkullanici, tweetsayisi, takipettigi, takipeden, nerden, bio, profilresmi, ismi) values ('', '$id', '$twk', '$tws', '$tkpettigi', '$tkpeden', '$nerden', '$bio', '$img', '$isim')";

$ak = mysql_query("select * from yyy where twitterid = '$id'");
if (mysql_num_rows($ak) == 0) {
    $sonuc = mysql_query($sql) or die(mysql_error());
    echo "You have been added to the cool list :)"; 
}
elseif (mysql_num_rows($ak) == 1) {
    $sonuc = "You are already on the cool list. No need to add you again :)";
}

?>

How can I correctly use mysql_real_escape_string for the variable $bio?

php sql mysql

Answer 1

Answer №1

It is important to ensure that you establish a connection to your MySQL database before proceeding.

$sql = "insert into yyy (id, twitterid, twitterkullanici, tweetsayisi, takipettigi, takipeden, nerden, bio, profilresmi, ismi) values ('', '$id', '$twk', '$tws', '$tkpettigi', '$tkpeden', '$nerden', '" . mysql_real_escape_string($bio) . "', '$img', '$isim')";

Please note that this information could have easily been located through a quick Google search or by referring to the PHP documentation.

In addition, it is recommended to apply this method for all strings and any data submitted by users, not just for select fields.

Answer 2

It is important to ensure that you establish a connection to your MySQL database before proceeding.

$sql = "insert into yyy (id, twitterid, twitterkullanici, tweetsayisi, takipettigi, takipeden, nerden, bio, profilresmi, ismi) values ('', '$id', '$twk', '$tws', '$tkpettigi', '$tkpeden', '$nerden', '" . mysql_real_escape_string($bio) . "', '$img', '$isim')";

Please note that this information could have easily been located through a quick Google search or by referring to the PHP documentation.

In addition, it is recommended to apply this method for all strings and any data submitted by users, not just for select fields.

Answer 3

Answer №2

The solution is simple - ditch the old ways. Switch to using parameterized queries with mysqli or even better, PDO

Here's an example from the PHP documentation using PDO:

<?php
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':value', $value);

// insert one row
$name = 'one';
$value = 1;
$stmt->execute();

// insert another row with different values
$name = 'two';
$value = 2;
$stmt->execute();
?>

Answer 4

The solution is simple - ditch the old ways. Switch to using parameterized queries with mysqli or even better, PDO

Here's an example from the PHP documentation using PDO:

<?php
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':value', $value);

// insert one row
$name = 'one';
$value = 1;
$stmt->execute();

// insert another row with different values
$name = 'two';
$value = 2;
$stmt->execute();
?>

How can one properly escape SQL queries using mysql_real_escape_string?

Answer №1

Answer №2

Similar questions

SQL statement not recognized

Get an Array Using AJAX in PHP and JavaScript

Retrieval of each single row from a PHP-generated JSON dataset

Transmitting the identification number of a post with the help of J

"Using jQuery to Access a View: A Step-by-Step Guide

Encountering a 403 error while using the YouTube API

How to retrieve the complete file path of an image during the image upload process

Using CakePHP, instantiate a new object and call the controller class from the index.php file located in the webroot directory

Get the image name from the database using the background:url property

Retrieving cover images using PHP from Google Books API

Please refresh the page after acknowledging the error

Having trouble with Codeigniter and Pdo? Getting an error that says "call to a member function

Using a single form, the rest of the form fields are restricted when uploading images with Ajax

Utilize a separate domain for sections of the URL within CodeIgniter

Using PHP's include/require method with a dynamic path

Aggregate the data in a 2-dimensional array by grouping rows based on one column and calculating the sum of another column within each group

Having trouble creating a Node.js equivalent to PHP's hash checking functionality

Running a Laravel artisan command on a schedule of every 5 seconds

filtering out specific sections of HTML using xPath

Analyzing MySQL queries to optimize performance on a webpage