PHP - Comment Protection Sql Injection Real Escape Strings Help.

I have never used real escape string so want to make sure I did it correctly. Also, if I can place it anywhere else to make it even more secure please let me know. This is just the action of a just a simple POST html form.

Here it is.
Code: [Select]
<?php
require ('staffarea/sql.php');
$showform="false";

$mcid = mysql_real_escape_string($_POST['mcid']);       
$age = mysql_real_escape_string($_POST['age']);
$description = mysql_real_escape_string($_POST['description']);

if(!mysql_query("INSERT INTO `somedatabase`.`appsubmissions` (`id`, `username`, `age`, `description`, `status`) VALUES (NULL, '$mcid', '$age', '$description', 'Pending');"))
{
echo '<div class=blockrow><b><font size=4>Submission Error</font><br /><br />Something went wrong. Contact Staff in the Support Forums and give them this information:<br /><br /></b><font color=red>';

echo mysql_error();

echo "</font>";

echo '<br /><br /><a href="/forumdisplay.php?f=14">Support Forums</a></div>';
}
else
{

$lastID=mysql_insert_id();

echo "<div class=blockrow><font size=3><b>$mcid, Thank You for your Building Application!</b></font><br /><br />";

echo "Your Unique Application ID: <b>", $lastID;

echo "</b> (save this so you can check the application status later)<br /><br />

Your application was submitted successfully. Please allow Staff 24 hours to accept or deny your application. If after 48 hours you still do not have building rights, assume the application was denied and re-submit with different information. DO NOT submit an application more than every 48 hours, doing so will get your account banned for spamming.<br /><br />

While waiting, you might check out the <a href=/index.php?pageid=mcguide>Ultimate Guide</a>.</div>";
}

mysql_close($con);

?>

on the first column do I need to escape that? "pm_id"
if so how do i do that with the right syntax
is it like this?
pm_id = '.mysql_real_escape_string.'


Code: [Select]
<?php $mail2 = "INSERT INTO pm SET pm_id = '', sendto = '".mysql_real_escape_string($to)."', sentfrom = '".mysql_real_escape_string($from)."' ?>
Also when you create a new row with a id  having auto increment. do i have to do id ="" so there isnt ever two rows matching the same id?

i have made function of prepare or check the mysql real escapte string but when i run this code it gives two warnings msg
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'SYSTEM'@'localhost' (using password: NO) in C:\wamp\www\cart\include\db.php on line 42

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in C:\wamp\www\cart\include\db.php on line 42
 kindly tell me what is this msg about how to solve it my code is
37 public function mysql_prep($value){
38 $magic_quotes_active=get_magic_quotes_gpc();
39v$new_enough_php=function_exists("mysql_real_escape_string");
40 if($new_enough_php){
   41if($magic_quotes_active){ $value=stripslashes($value);}
   42 $value= mysql_real_escape_string($value);}
   43 else {
   44   if($magic_quotes_active){$value=addslashes($value);}
      
   45}
   46   return $value;
      
48 }

I have a comment section that is secure against everything except spam..
Is there anyway to do like a 10second minimum wait time between posts?

I am having problems with these slashes. They keep showing up when I echo data....
The code is to update a field in a mysql database table.

Here is my code:
Code: [Select]
$query = mysql_query("SELECT * FROM `bus` WHERE username='$username'");
$row = mysql_fetch_array($query);
$bio = $row['about'];
$bio = str_replace("<br />","\r\n",$bio);



if(isset($_POST['submit'])){
if(empty($errors)){
if($password == $pass){

$about1 = mysql_real_escape_string($_POST["about"]);
$about1 = str_replace("\r\n","<br />",$about1);

mysql_query("UPDATE bus SET about='$about1' WHERE username='$username'");

}else{$errors[] = 'Incorrect Password';}
}
}

When I run this and put:
About: 
I'm very tired today
It's been very hard

I get the about1 string as: I\\\'m very tired today\r\nIt\\\'s been very hard

Why???

I currently use the following function to clean form inputs to prevent MySql injection,

Does this function do enough to prevent MySql injection? is there anything i have missed?

 
<?php

//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}

?>

CREATE TABLE posts (
postId INT(11) NOT NULL UNIQUE AUTO_INCREMENT,	
title VARCHAR(255) NOT NULL,
author VARCHAR(24) NOT NULL,	
description TEXT NOT NULL,       
createdAt TIMESTAMP,
PRIMARY KEY (postId)    
);
CREATE TABLE comments(
commentId INT(11) NOT NULL UNIQUE AUTO_INCREMENT,    
comment  TEXT NOT NULL,
postId INT(11),
userId INT(11),
createdAt TIMESTAMP,	
PRIMARY KEY (commentId),
FOREIGN KEY (userId) REFERENCES users(userId),
FOREIGN KEY (postId) REFERENCES posts(postId)   
);
CREATE TABLE replies (
repId INT(11) NOT NULL UNIQUE AUTO_INCREMENT,   
reply  TEXT NOT NULL,
userId INT(11),
commentId INT(11), 	
createdAt TIMESTAMP,     
PRIMARY KEY (repId),
FOREIGN KEY (userId) REFERENCES users(userId),
FOREIGN KEY (commentId) REFERENCES comments(commentId)     
);
CREATE TABLE users (
userId INT(11) NOT NULL UNIQUE AUTO_INCREMENT,
userName VARCHAR(100) NOT NULL,,	          
email VARCHAR(100) NOT NULL,
PRIMARY KEY (userId)
);

how to retrive userName,comment, and createdAt from users and comments table while I have used userId as a  Foreign key on the comment table

if it isn't correct, correct me please

This topic has been moved to Ajax Help.

http://www.phpfreaks.com/forums/index.php?topic=322815.0

I want to password protect my entire website. How would I go on to doing this. There is a website that has this already (www.printerdev.co.uk). I want to do the exact same thing but not sure how to.

Can someone please help me

I have been getting a lot more client requests to protect files.  What is the easiest way to do this. 
So, basically I have tried doing it outside the public directory. There are too many things that cause
issues with this. I haven't been able to get a successfull implementation of this since I started working with this.

So I was thinking instead about password protecting a directory that is inside public view, but still get files via PHP.  Is
there a way to setup a password protected directory, then retreive stuff from that directory using PHP.

Or, a good way to put them outside the public folder. Everything I have tried to do to get a file to save outside of public view,
has not worked. It always says uploaded but the file is never there. Also, I have verified correct permission for this as well.

how would this code work?
Code: [Select]
if ($_POST['username'] == "[, ., ,, _, -" ){
 die('Invalid characters.');
i want it to mean if there are any characters like ", [ . - _ ' " or anything in the username then die('invalid characters.'); for extra safety

I need to know, what i need to care about while im coding, how someone can hack my php code.
Some tricks for protection pls?

hello. im trying to password protect my pages in a simple way like this: http://www.scottconn...ord_protection/   but for some reason it doesnt chek the login file, so it doesnt work:

<?php require_once 'login.php'; ?>

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Untitled Document</title>
<style type="text/css">
#form1 table tr td label {
}
#form1 table {
	text-align: left;
}
#wrapper {
  margin: 20px auto;
  text-align: center;
  font-size: 20px;
}
#wrapper2 {
  margin: 20px auto;
  text-align: center;
  font-size: 20px;
}
</style>
</head>

<body>

<div id="wrapper">
--<a href="tilfojer.html">Tilføj Aktivitet</a>--<br>
--<a href="tilfojtilvalg.html">Tilføj Tilvalg</a>--<br>
--<a href="tilfojrestaurant.html">Tilføj Restaurant</a>--<br>
--<a href="tilfojmenu.html">Tilføj Menu</a>--
</div>

<div id="wrapper2">
--<a href="seaktivitet.php">Se Aktiviteter</a>--<br>
--<a href="setilvalg.php">Se Tilvalg</a>--<br>
--<a href="serestaurant.php">Se Restauranter</a>--<br>
--<a href="semenu.php">Se Menuer</a>--
</div>

</body>

<a href="?logout=1">Logout</a>
</html>

that is how i implemented it. made the file an php file   can somone tell me why it doesnt work. and maybe how to make it work, and why that works   many thanks

I have a contact form, and I want to make sure it doesn't send a bunch of duplicates if the page is refreshed after being submitted.

Simple way is to make sure this record isn't identical to the one before it:

select * from `contacts` where `Name`='$name' and `Phone`='$phone' and `Message`='$message' and `Subject`='$subject' and `Email`='$email'

But, that checks against all records. While not likely, this could cause problems, if the same customer came back a month later and put in the same exact contact. Any way I can check it only against the very last record in the database? Something like: and `id`=XX , where XX is one less than the current auto inc id?