0

when I try to insert data into database using msqli_real_escape_string the php code is being echoed out on submit like this here is my code 

<?php 
  include_once 'db.php'; 

  $first= mysqli_real_escape_string($conn, $_POST['first']);
   $last=  mysqli_real_escape_string($conn, $_POST['last']);
    $email=  mysqli_real_escape_string($conn, $_POST['email']);
     $uid=  mysqli_real_escape_string($conn, $_POST['uid']);
      $pwd=  mysqli_real_escape_string($conn, $_POST['pwd']);


$sql = "INSERT INTO users (user_first, user_last, user_email, user_uid, user_pwd) VALUES         ('$first', '$last', '$email', '$uid', '$pwd');";
$results = mysqli_query($conn, $sql);

header("location:../index.php?signup=succes");

     ?>

what am I doing wrong?

Your Common Sense
  • 156,878
  • 40
  • 214
  • 345
Rheo
  • 165
  • 1
  • 2
  • 11
  • 2
    That PHP code is visible in the browser? Are you sure PHP is installed on your server and the file containing this code has a ".php" extension? – rickdenhaan Oct 21 '17 at 18:41
  • 2
    And please do not use real escape string. Use prepared/parameterized queries and be properly protected against sql injection hacks – JimL Oct 21 '17 at 18:44
  • Note: The object-oriented interface to `mysqli` is significantly less verbose, making code easier to read and audit, and is not easily confused with the obsolete `mysql_query` interface. Before you get too invested in the procedural style it’s worth switching over. Example: `$db = new mysqli(…)` and `$db->prepare("…")` The procedural interface is an artifact from the PHP 4 era when `mysqli` API was introduced and should not be used in new code. – tadman Oct 21 '17 at 18:50
  • **WARNING**: When using `mysqli` you should be using [parameterized queries](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and [`bind_param`](http://php.net/manual/en/mysqli-stmt.bind-param.php) to add user data to your query. **DO NOT** use manual escaping and string interpolation or concatenation to accomplish this because you will create severe [SQL injection bugs](http://bobby-tables.com/). Accidentally unescaped data is a serious risk. Using bound parameters is less verbose and easier to review to check you’re doing it properly. – tadman Oct 21 '17 at 18:50
  • **WARNING**: Writing your own access control layer is not easy and there are many opportunities to get it severely wrong. Please, do not write your own authentication system when any modern [development framework](http://codegeekz.com/best-php-frameworks-for-developers/) like [Laravel](http://laravel.com/) comes with a robust [authentication system](https://laravel.com/docs/master/authentication) built-in. At the absolute least follow [recommended security best practices](http://www.phptherightway.com/#security) and **never store passwords as plain-text**. – tadman Oct 21 '17 at 18:50
  • I don't know what programming resource you're using to learn how to do this, but whatever it is I have a sneaking suspicion it's a really awful one. This kind of code fell out of fashion in the 1990s and for good reason: It's like juggling chainsaws on a unicycle, extremely dangerous even when you're doing it properly. – tadman Oct 21 '17 at 18:52

0 Answers0