MySQL sanitize on mysql_fetch_row

Question

I have the following code:

$username = $_SESSION['username'];      
$query = ("SELECT id FROM users WHERE username = '$username'");
$result = mysql_query($query) or die (mysql_error());
$row = mysql_fetch_row($result);
$user_id = $row[0];

Where should I apply mysql_real_escape_string here? Would $user_id = mysql_real_escape_string($row[0]); work?

I know that MySQL should be left in the past. I'll move to MySQLi soon enough.

You want to apply it to potential user input, not your output — SubjectCurio, Oct 17 '13 at 08:46
Ok. So I should use mysql_real_escape_string only for $_POST['something'], right? — SporeDev, Oct 17 '13 at 08:48
Please note that all the `mysql_xxx()` functions in PHP are deprecated and have been considered obsolete for years. You really need to read [Why shouldn't I use mysql_* functions in PHP?](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). — Spudley, Oct 17 '13 at 08:51
@SporeDev not just for $_POST, **anything** that could potentially come from the user should be escaped, POST, GET, SESSION, COOKIE etc... as a rule of thumb, **never** trust any input coming from a user — SubjectCurio, Oct 17 '13 at 10:33

score 0 · Accepted Answer · answered Oct 17 '13 at 08:49

0

do this in first line:

$username = mysql_real_escape_string($_SESSION['username']);

and change query to this:

$query = ("SELECT id FROM users WHERE username = '".$username."'");

answered Oct 17 '13 at 08:49

Adam

1,371
2
11
12

Thank you Adam. I want to ask you something. Why did you wrote the query the way you did? It's a concatanation, is it not? – SporeDev Oct 17 '13 at 08:51
@SporeDev Query doesn't need to change, so long as the first line comes above the query, the concatenation makes no difference to the query, other than any performance differences. – naththedeveloper Oct 17 '13 at 08:53
Would those performance differences be for the better or worst? – SporeDev Oct 17 '13 at 08:55
@SporeDev - FDL's right. This form of query is in my opinion clearer. – Adam Oct 17 '13 at 08:56
2

@SporeDev there is no difference. it's just a matter of taste – Your Common Sense Oct 17 '13 at 08:57
I'm glad I could help :) @SporeDev Don't forget to approve the answer ;) – Adam Oct 17 '13 at 09:05

MySQL sanitize on mysql_fetch_row

1 Answers1