1

here is my code

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

$name = mysqli_real_escape_string($conn, $_POST["name"]);
$address = mysqli_real_escape_string($conn, $_POST["address"]); 
$city = mysqli_real_escape_string($conn, $_POST["city"]);
$state = mysqli_real_escape_string($conn, $_POST["state"]);
$zipcode = mysqli_real_escape_string($conn, $_POST["zipcode"]); 
$country = mysqli_real_escape_string($conn, $_POST["country"]);
$month = mysqli_real_escape_string($conn, $_POST["month"]);
$day = mysqli_real_escape_string($conn, $_POST["day"]);

How do I know if its properly working?

mycelium
  • 5
  • 2
  • 1
    Define "properly working". As in, keeping you safe from SQL injection? The answer to that question is sort of yes: http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string/12118602#12118602 – Jeremy Harris Dec 16 '16 at 20:24
  • 1
    Learn to use prepared statements so you don't have to worry about this. – Barmar Dec 16 '16 at 20:35
  • You can echo the query to see if special characters are properly escaped. – Barmar Dec 16 '16 at 20:35
  • mysqli is a very popular library. If something as basic as this didn't work properly, I don't think people would use it. What makes you think it might not work? – Barmar Dec 16 '16 at 20:37

0 Answers0