-2

I want to store some download counts with the name of the downloadfile in a database. This is working fine:

$filename = $_GET['file'];
// in combination with
mysqli_query($link, "INSERT INTO download_manager (filename,downloads) 
                         VALUES ('$filename',1) ON DUPLICATE KEY UPDATE downloads = downloads+ 1;");

Now i want to escape the $_GET with mysqli_real_escape_string

When i do it like this, the script is not working anymore:

$filename = mysqli_real_escape_string($_GET['file']);
// in combination with
mysqli_query($link, "INSERT INTO download_manager (filename,downloads) 
                         VALUES ('$filename',1) ON DUPLICATE KEY UPDATE downloads = downloads+ 1;");

How can i use the mysqli_real_escape_string in this example on the right way?

Dharman
  • 30,962
  • 25
  • 85
  • 135
nuet maessen
  • 131
  • 10

1 Answers1

0

from php document mysqli_real_escape_string Procedural style

string mysqli_real_escape_string ( mysqli $link , string $escapestr )

so your code should be

$filename = mysqli_real_escape_string($link,$_GET['file']);