Prevent HTML insert into MySQL Table

Question

I've coded a little comment function on my website by PHP. I have noticed that there is a huge security risk. Users can write some HTML/PHP/MySQL and insert it into the table. Is there a easy way to prevent this?

This is my PHP insert script:

<?php
    if ( $_SERVER["REQUEST_METHOD"] == 'POST' ) {
    $kommentar_neu = $_POST["kommentar"];

    if (!empty($kommentar_neu)) { 
        $order = "INSERT INTO $db_kommentare
        (kommentar, teilnehmer, kommentardatum, projektnummer)
        VALUES
        ('$kommentar_neu', '$teilnehmer_name', '$zeiteingabe', 
         '$projektnummer_hw_order')";
    }
    }
?>

http://stackoverflow.com/questions/110575/do-htmlspecialchars-and-mysql-real-escape-string-keep-my-php-code-safe-from-inje — Funk Forty Niner, Oct 13 '15 at 14:27
no, don't use mysql_real_escape_string. It's deprecated. http://php.net/manual/de/function.mysql-real-escape-string.php .. — Daniele D, Oct 13 '15 at 14:39
the other guy deleted his comments, so it looked like I was talking to myself. — Daniele D, Oct 13 '15 at 14:47

Tripp Kinetics · Accepted Answer · 2015-10-13T14:29:14.423

1

The problem you are describing is called "SQL Injection". There are many methods for dealing with it, and so the answer would be too long for this format, but Googling "SQL Injection" should get you started.

In any case, NEVER EVER EVER (well, with one notable exception...) create SQL statements by stringbashing. Create a prepared statement with parameters and pass them in.

A good starting point might be:

http://php.net/manual/en/security.database.sql-injection.php

This covers the injection of SQL into SQL, but some of the principles involved are applicable.

edited Oct 13 '15 at 14:29

answered Oct 13 '15 at 14:27

Tripp Kinetics

5,178
2
23
37

it's a dupe then of http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 – Funk Forty Niner Oct 13 '15 at 14:28
3

Not only SQLi, but also XSS. – Jiri Tousek Oct 13 '15 at 14:30

innovative kundan · Answer 2 · 2015-10-13T14:48:27.740

-3

There are various method you can use to prevent such thing. $your_variable;

$filter_variable = htmlspecialchars($your_variable);
$filter_variable = mysqli_real_escape_string($conn,$your_variable);

use prepare statement for create your sql query.

hope it will help you.

Happy coding.

edited Oct 13 '15 at 14:48

answered Oct 13 '15 at 14:28

innovative kundan

631
6
13

stop telling people to use deprecated functions. mysql_* functions are deprecated. We are in 2015 ffs. http://php.net/manual/de/function.mysql-real-escape-string.php – Daniele D Oct 13 '15 at 14:38

Prevent HTML insert into MySQL Table

2 Answers2