Forum Moderators: coopster
<?php
$con = mysql_connect("localhost","user","pass");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("application", $con);
$sql="INSERT INTO applications (first_name, interest) VALUES ('{$_POST['first_name']}', '{$_POST['interest']}')";
if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error());
}
header( 'Location: thankyou.php' ) ;
mysql_close($con)
?>
htmlspecialchars(), whatever, before you send it to the browser, not the DB).
mysql_real_escape_string( $text, $connection )'.
<?php
$con = mysql_connect("localhost","user","pass") or die("Could not connect:".mysql_error());
mysql_select_db("application", $con);
$sql = "INSERT INTO `applications` (`first_name`, `interest`) VALUES ('". mysql_real_esscape_string(htmlspecialchars($_POST['first_name']))."', '". mysql_real_escape_string(htmlspecialchars($_POST['interest']))."') ";
if (!mysql_query($sql,$con)){
echo "there was an error";
}
else{
echo "Successfully added";
}
header("Location: thankyou.php");
mysql_close($con);
?>
Do not ever, ever, ever post user-input direct into MySQL without checking/cleaning. If you do so, your site will be hacked in days, if not hours.
The syntax that you are going to use, therefore, is something like: `mysql_real_escape_string( $text, $connection )'.
In the end, whatever you decide to do, be consistent throughout, and also, make sure that you document it!
You can do it OTF or outside, that's up to you
There are others, but depends on the context of your project I guess
That's sort what your looking at, though you can use array_map to apply the functions before the sql string to make things a little easier to read, hope this makes sense to you.
Also, so long as there is a connection going, mysql_real_escape_string() & any other function that uses a connection handle will inherit the last 'inuse' connection that is established to the server, so you can leave the parameter blank if you wish :)
you don't necessarily need to explicitly close the connection, because after each query it's automatically done
mysql_real_escape_string is a way to perform this checking/cleaning, right? I'm sorry; this confused me a little as it seems you're saying I'm still missing something.
mysql_real_escape_string is a way to perform this checking/cleaning, right?
mysql_real_escape_string()(as you have discovered) will help you get all sorts of problematic characters into the DB. It *is* also vital when you use user-input to search the DB. The reason for this latter is because so many people will attempt to send specially-crafted strings to hack your website - the main villain there is the `;' character. Nevertheless, the reason for my statement is that you need to get into the habit of coding checks for user-input as early as possible.
$sql=INSERT INTO ... $_POST['first_name']...it makes me shiver. I'm a webmaster as well as programmer, and I spend time looking at server logs. I therefore see the raw strings that are sent to my server. Please understand, there are hundreds of attempts to hack my server each day (mine is not unique in this). You need to educate yourself in website & server security from day one.
None of those two paragraphs made sense
$connectionitem.
$connection = mysql_connect('localhost','user','pass');
mysql_select_db($db, $connection);
$connectionas a parameter.
mysql_real_escape_string()is just one example of those. IF YOU ONLY HAVE ONE DB OPEN, it is not *required* to include the parameter (the function then makes use of the last-used value). Personally, I always include it.
