PHP - Info About Mysql_real_escape_string() Needed, What Does It Do, How To Use It ?

Hello and thanks in advance for the input.  I a fully functioning form.  I am validating the input and successfully inserting the input into the mysql database.  Now I am trying to escape the data by adding the basic line of code:

$name = mysql_real_escape_string($_POST['name']);

The input is successful but the mysql_database for name field is empty.  If I remove the above line of code and just input the value for $name (without escape) the update works great.  So the question is obvious for the above.  Why?

Code: [Select]
$update = "UPDATE model SET name = '$name', age = '$age', height = '" . mysql_real_escape_string($height) . "', hair = '$hair', bust = '$bust', waist = '$waist', hips = '$hips' ......... WHERE id = '$id' ";
$rsUpdate = mysql_query($update);
After reading the manual at php.net on this function, I should be inserting the mysql_real_escape_string for each variable, correct? Right now I just have it for $height. The reason I'm asking is because I have 28 columns in this table and want to make sure I'm using this function properly as it seems like a tedious process and messy code.

hey guys,
just wondering, is it advisable to use mysql_real_escape_string() with <select> boxes, i know the web designer will always set the values for options within select boxes, therefore there shouldn't be any danger, but then i found such js code as:

Code: [Select]
javascript:document.body.contentEditable='true'; document.designMode='on'; void 0
(this allows the user of any site to edit content on the users end)

so with something like the above, is it at all possible for a user to alter the option values within a select box and successfully submit the altered form?

thanks

I just red few tutorials about  mysql_real_escape_string. Could someone check if this is correct?

<?php
$conn = mysql_connect("localhost","myusername","thepassword1");
mysql_select_db("mydataB", $db);

$result = mysql_query("SELECT * FROM applicant WHERE username = '$username'");

if (mysql_num_rows ($result) > 0){
$register = "&err=Not Available.";
echo($register);
} else {
$username = mysql_real_escape_string($_POST['username'], $db);
$password = mysql_real_escape_string($_POST['password'], $db);
$name = mysql_real_escape_string($_POST['name'], $db);
$email = mysql_real_escape_string($_POST['email'], $db);
$id = mysql_real_escape_string($_POST['id'], $db);

mysql_query("INSERT INTO applicant (username, password, name, email, id) VALUES ('$username', '$password', '$name', '$email', '$id')");
$register = "Successful.";
echo($register);
}
?>

This code gives an error. Please help fix.

$mydb = mysql_connect("localhost","my_un","my_pw");
mysql_select_db("my_db");

$query =sprintf("SELECT * FROM  idb1 WHERE username = '%s' AND authority = 'Banned'", mysql_real_escape_string($userNm));
if(mysql_num_rows($query)) {
$login = "&err=Not allowed.";
echo($login);
} else {

$result=sprintf("SELECT * FROM  idb1 WHERE username = '%s' AND password ='%s'", mysql_real_escape_string($userNm), mysql_real_escape_string($passWd));
if(mysql_num_rows ($result) == 0) {
$login = "&err=Retry!!";
echo($login);
} else {
$row = mysql_fetch_array($result);
$userNm=$row['username'];
$passWd=$row['password'];
$login = "$userNm=" . $userNm . "$passWd=" . $passWd . "&err=Successful.";
echo($login);
}
}

Is it correct to use mysql_real_escape_string() function on every query that i wonna insert or search ?
I have fields like TEXT(dectription of article), VARCHAR(name of article) and more like that, and is there correct to use mysql_real_escape_string for all fields when query is INSERT  ?

Is it necessary to use mysql_real_escape_string() when I'm retrieving fields from a table that the user had no input on the result?

Such as if there was a template color that the admin set in the siteconfig table that the script selects automatically with no user input.

Cheers!

What is wrong with the injection preventer (array function) seen below:

//injection prevention
if (isset($_GET)){
    if (!is_array($_POST)){
        foreach( $_POST as $key => $value){
        $_POST["$key"]=mysql_real_escape_string($value) ;
        }



    } else {//here
        while (is_array($key)){
            foreach( $_POST as $key => $value){
            $_POST["$key"]=mysql_real_escape_string($value) ;
                echo $key;
            }
    }
}

Hi, I am trying to make a blog system in php and mysql and just about got it working except for one thing. I need to sanitise the fields, both to prevent against sql injection and to allow the bloggers to use punctuation such as quotes. this is the query code I have so far:


if($_SERVER["REQUEST_METHOD"] == "POST") {
   $post_title = $_POST['posttitle'];
   $post_content = $_POST['postcontent'];
   $post_content = mysql_real_escape_string($post_content);
   $query=mysql_query("INSERT INTO 'blog'('Title','Content') VALUES

('$post_title','$post_content')",$connect);
   header("Location:index.php?page=afterpost&post=".mysql_insert_id());

}

I can't see why that isn't working, but when I type something in with a quote in it it just doesn't submit to the database. Without a quote works fine. If I try echo $post_content;, it comes up with backslashes before the quotes so the mysql_real_escape_string seems to be working. What am I doing wrong?

Thanks in advance.

the mysql_real_escape_string does not add slashes when it enter my db y

Code: [Select]
if(isset($_POST['submitbtn'])){

//will open up the db connection
require_once"../includes/connect.php";

$errors = "";
$welcometitle = mysql_real_escape_string($_POST['welcometitle']);
$welcomesection = mysql_real_escape_string($_POST['welcomesection']);
$infotitle = mysql_real_escape_string($_POST['infotitle']);
$infosection = mysql_real_escape_string($_POST['infosection']);
$videotitle = mysql_real_escape_string($_POST['videotitle']);
$videosection = mysql_real_escape_string($_POST['videosection']);


if(isset($welcometitle, $welcomesection) && !empty($welcometitle) && !empty($welcomesection)){
if(isset($infotitle, $infosection) && !empty($infotitle) && !empty($infosection)){
if(isset($videotitle, $videosection) && !empty($videotitle) && !empty($videosection)){

//adding them to the db
//adding them to the db
$query = mysql_query("UPDATE `home` SET `welcometitle`=  '$welcometitle', `welcomesection`= '$welcomesection', `infotitle`='$infotitle',
`infosection`= '$infosection',`videotitle`= '$videotitle',`videosection`= '$videosection'") or die(mysql_error());

header("location: http://www.website.org/control/edithome");

}else{
$errors = "Please fill in the Video Section";
}
}else{
$errors = "Please fill in the Info Section";
}
}else{
$errors = "Please fill in the Welcome Section";
}

mysql_close();//will close the inlcude db connection
}

?>

Never had this one before.

Here's a string from a URL:
$urltext = Product_Name_'with_single_quotes'_"_B
Code: [Select]
$name = str_replace( "_", " ", $urltext );
echo 'raw: ' . $name . "<br>";
$name = mysql_real_escape_string( $name );
echo 'mysql_real_escaped: ' . $name . '<br>';

Doesn't seem possible, but both of the "echos" return the same string. My query fails because there are no backslashes in the SQL statement. What's going on here?

raw: Product Name 'with single quotes' " B
mysql_real_escaped: Product Name 'with single quotes' " B

I have an AJAX script which queries a DB when a user inputs a search text. That's great, works well.

However, when I use mysql_real_escape_string, it seems to completely rid the '$q'. When I don't use it, it works well but of course, there's the security side of things.

Here's the code snippet:

<?php
error_reporting(E_ALL);
$q = $_GET["q"];//added mysql_real_escape_string
//$q = mysql_real_escape_string('$_GET["q"]');

$con = mysql_connect("localhost","aaaaa","aaaaa");

if (!$con)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("aaaaa", $con);

$sql="SELECT * FROM articles WHERE keywords LIKE '%$q%'";
?>

It seems so simple, but its just not working. What could it be?

I keep getting the following error:

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established

With this code:

<?php


$level = $_POST[level];
$first = $_POST[first];
$second = $_POST[second];
$third = $_POST[third];
$fourth = $_POST[fourth];

$mysqli = new mysqli("*****", "*****", "******", "********");
    if ($mysqli === false) {
      die("ERROR: Could not connect to database. " . mysqli_connect_error());
    }

$vidlink=mysql_real_escape_string($_POST[vidlink]);
$title=mysql_real_escape_string($_POST[title]);
$des=mysql_real_escape_string($_POST[des]);
$website=mysql_real_escape_string($_POST[website]);

$cat= mysql_real_escape_string($first . $second . $third . $fourth);

why won't it work?

If i use mysql_real_escape_string() whilst inserting data...and that data contained 'common sql injection chars' - im guessing it would escape/backslash them?

So say if I now wanted to select/extract that data from the DB, would the data contain the slashes or would the slashes be automatically removed/stripped?