Problems with mysqli_real_escape_string, inserting string works fine

Asked May 15 '18 at 09:44

Active May 15 '18 at 10:34

Viewed 32 times

Trying to insert the Cookievalue into my database. Like this it's not Working (=no new data in the db)

$con = mysqli_connect("", "root", "", "db");
$firstname = mysqli_real_escape_string($con, $_COOKIE['firstname']);
$sql = "INSERT INTO table (firstname) VALUES ($firstname)";
mysqli_query($con, $sql);

but if I insert the VALUE like 'hello' it works fine.

edited May 15 '18 at 10:34

asked May 15 '18 at 09:44

Code Zilla

3

Dont use it, its not safe! Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) in either the `MYSQLI_` or `PDO` API's – RiggsFolly May 15 '18 at 09:45
Please add the issue you are facing in the question. – Nandan Chaturvedi May 15 '18 at 09:45
try it $sql = "INSERT INTO table (firstname) VALUES ('$firstname')"; – Rahul May 15 '18 at 09:45
@RiggsFolly why is it not safe? P.S.: Im a new coder – Code Zilla May 15 '18 at 10:32
[SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – RiggsFolly May 15 '18 at 10:33
And thank you @Rahul Shrivastava, it really worked ;) – Code Zilla May 15 '18 at 13:09

Problems with mysqli_real_escape_string, inserting string works fine

0 Answers0