-2

SELECT * FROM Users WHERE UserId = " + txtUserId

How do I prevent data injection?

The following code is appropriate?

$username = mysqli_real_escape_string( $GET['username'] );
mysql_query( "SELECT * FROM tbl_members WHERE username = '".$username."'");
Cœur
  • 37,241
  • 25
  • 195
  • 267
asghar68
  • 1
  • 2

1 Answers1

-1

PDO will protect you from injections http://php.net/manual/en/book.pdo.php Use prepared statements http://php.net/manual/en/pdo.prepared-statements.php For example:

$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':value', $value);
$stmt->execute();

This is a secure code

user3798618
  • 758
  • 1
  • 7
  • 12
  • Please [avoid link only answers](http://meta.stackoverflow.com/tags/link-only-answers/info). Answers that are "barely more than a link to an external site” [may be deleted](http://stackoverflow.com/help/deleted-answers). – Quentin Apr 16 '17 at 07:33
  • @Quentin Added an example. – user3798618 Apr 16 '17 at 07:37