Stack Overflow
Stack Overflow

How do I make – Mini Sini Pi Jul 05 '15 at 05:26

  • possible duplicate of [How can I prevent SQL-injection in PHP?](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Dan Getz Jul 05 '15 at 05:29
  • I still don't get it, I thought thered be a simple solution – Mini Sini Pi Jul 05 '15 at 05:33
  • 1
    The solution is do not use any user input in without escaping in SQL statements. This must be done on the server side since you cannot trust the client. See http://bobby-tables.com/. The problem is not only for SQL statements but for everything from the user. I recommend you learn about various kind of attacks like XSS, CSRF, SQL injection ... before starting any serious web development, otherwise your server and also the clients are at risk. – Steffen Ullrich Jul 05 '15 at 05:35
  • 1
    Ah, the little hitlers have decided that this is not a good question. It seems to me (as others) that it is verifiable, does include enough information and the desired behaviour is obvious... Not to fail !!! :-) – Rohit Gupta Jul 05 '15 at 20:36

    • 3 Answers3

    1

    To prevent SQL -injection you should use Stored Procedures.

    CREATE PROCEDURE saveText
    @textArea nvarchar(50)
AS 
SET NOCOUNT ON;

INSERT INTO myTable 
    (textArea)
VALUES
    (@textArea)

    GO

    This way, you will have no problems when you have a ' in your input.

    Noidz
    • 35
    • 7
    0

    You need to escape the string that you have typed so that the sql engine does not get confused. 

    $input = $_POST["textarea"];
$safe_input = mysql_real_escape_string($input);

    You need to use this in your sql statement.

    WARNING

    As others are trying to tell you, you are leaving yourself open to sql injection attacks. Once you have the above working , you should read up on it. There is a link in the comments above.

    Rohit Gupta
    • 4,022
    • 20
    • 31
    • 41
    0

    $input = $_POST["textarea"]; $safe_input = addslashes($input);

    rapidRoll
    • 300
    • 1
    • 9