Php 'update' command script possibly needs sql injection protection?

Question

My database recently suffered from a sql injection attack, mostly because I am relatively new to programming and did not know about something like that. I have been trying to learn how to prevent them, but I cannot figure out how for this script. I do have another type of script that I successfully implemented though. How can I prevent an sql injection attack using this script?

<?php

$autor = $_GET["multi"];
$autop = $_GET["multis"];

$sql = "UPDATE autoj SET autob = '$autop' WHERE autoq = '$autor'";

$hd = "something";
$dd =  $_GET['something'];
$ud = "something";
$pd = "something";

$mysqli = new mysqli($hd, $ud, $pd, $dd); 
if (mysqli_connect_errno()) {
   printf("Connect failed: %s\n", mysqli_connect_error());
   exit();
}

$result = $mysqli->query($sql);
if ($result) {
....

Are you going to ask a separate question for the every script you have? — Your Common Sense, May 04 '13 at 16:01

score 1 · Answer 1 · edited Jun 20 '20 at 09:12

1

How can I prevent an sql injection attack using this script?

Exactly the same way as other one

edited Jun 20 '20 at 09:12

Community

1
1

answered May 04 '13 at 16:00

Your Common Sense

156,878
40
214
345

score 0 · Accepted Answer · answered May 04 '13 at 16:02

0

Try this:

$hd = "something";
$dd = "PUT SOMETHING HERE";
$ud = "something";
$pd = "something";

$mysqli = new mysqli($hd, $ud, $pd, $dd); 
if (mysqli_connect_errno()) {
   printf("Connect failed: %s\n", mysqli_connect_error());
   exit();
}

$autor = $_GET["multi"];
$autop = $_GET["multis"];
$autor = $mysqli->real_escape_string($autor);
$autop = $mysqli->real_escape_string($autop);

$sql = "UPDATE autoj SET autob = '$autop' WHERE autoq = '$autor'";

Also, on line two, I see you used $_GET['something'] to select a database. Don't.

answered May 04 '13 at 16:02

Dave Chen

10,887
8
39
67

$dd comes from a different script. That's all I need to be protected? – Boog Tracki May 04 '13 at 16:08
`$dd = $_GET['something'];` was in the original code. – Dave Chen May 04 '13 at 16:09

score -1 · Answer 3 · answered May 04 '13 at 16:02

-1

use mysqli_real_escape_string http://php.net/manual/en/mysqli.real-escape-string.php

answered May 04 '13 at 16:02

Biswajit Maji

869
13
23

Php 'update' command script possibly needs sql injection protection?

3 Answers3

Exactly the same way as other one