Will my code prevent SQL injection

Question

i have searched and added some prevention code but i need expert advice am i correct ?

I have made seperate file for SQL connect but i have confusion whether i should use include, require, include_onces or any other ?

mysql_connect("localhost", "userr", "pass") or die(mysql_error()) ; 
mysql_select_db("databse") or die(mysql_error()) ;

Here i have added two things UTF8 and mysql_real_escape_string.

$bad='anyone123';

$var = mysql_real_escape_string($bad);
$q = mysql_query('SET user_id UTF8');
$q = mysql_query("SELECT * FROM fbusers WHERE user_id = '$var'");
$r = mysql_fetch_array($q);

Please give me advice if how can i prevent injec. to 100% i don't want my website to be hacked :(

Thank you

What is the problem in mysql ? i have coded my website in mysql :( — user2615947, Aug 11 '13 at 23:04
@user2615947 you only need to search and remove mysql_* methods with mysqli_* — furier, Aug 11 '13 at 23:07
There is a clear statement at [the docs](http://www.php.net/manual/en/function.mysql-connect.php) (which you should be referring to often) that the mysql extension is deprecated and will be removed in future. — Andy G, Aug 11 '13 at 23:08
@furier Yes mysql to mysqli i can do... that anymore advice ?? — user2615947, Aug 11 '13 at 23:09
The only thing that will prevent injections for sure is using parametrized queries, whether in mysqli or PDO. Please learn about using parametrized queries, preferably with the PDO module, to protect your web app. http://bobby-tables.com/php has examples to get you started. — Andy Lester, Aug 12 '13 at 01:05

score 0 · Answer 1 · edited May 23 '17 at 12:05

0

You need to use prepared statements for any queries that require user input. This sends the query and the parameters seperately and acts as a layer of security to catch any malicious input.

In PDO:

$stmt = $pdo->prepare("SELECT * FROM fbusers WHERE user_id = :var");

$stmt->execute(array(':var'=>$var));

In mysqli:

$stmt = $dbConnection->prepare('SELECT * FROM fbusers WHERE user_id = ?');
$stmt->bind_param('s', $var);

$stmt->execute();

Maybe this post would help.

edited May 23 '17 at 12:05

Community

1
1

answered Aug 11 '13 at 23:14

Dolchio

469
2
12

I would really appreciate if you could give in mysqli rather then pdo – user2615947 Aug 11 '13 at 23:19

Will my code prevent SQL injection

1 Answers1