PHP - Mysql_real_escape_string Only When Needed?

I just red few tutorials about  mysql_real_escape_string. Could someone check if this is correct?

<?php
$conn = mysql_connect("localhost","myusername","thepassword1");
mysql_select_db("mydataB", $db);

$result = mysql_query("SELECT * FROM applicant WHERE username = '$username'");

if (mysql_num_rows ($result) > 0){
$register = "&err=Not Available.";
echo($register);
} else {
$username = mysql_real_escape_string($_POST['username'], $db);
$password = mysql_real_escape_string($_POST['password'], $db);
$name = mysql_real_escape_string($_POST['name'], $db);
$email = mysql_real_escape_string($_POST['email'], $db);
$id = mysql_real_escape_string($_POST['id'], $db);

mysql_query("INSERT INTO applicant (username, password, name, email, id) VALUES ('$username', '$password', '$name', '$email', '$id')");
$register = "Successful.";
echo($register);
}
?>

Hi, just wondering do i need to use mysql_real_escape_string() on login information (username and password). I use it as shown below but get an error when connecting.

Code: [Select]
if(isset($_POST['submit'])){
if( empty($_POST['uname']) && (empty($_POST['upass']))){
header( "Location:Messages.php?msg=1" );
exit();
}

$n=mysql_real_escape_string($_POST['uname']);
$p=mysql_real_escape_string($_POST['upass']);

include('config.php');
$query="select * from country where uname='$n'  and pw='$p'";
$result=mysql_query($query);

Is it correct to use mysql_real_escape_string() function on every query that i wonna insert or search ?
I have fields like TEXT(dectription of article), VARCHAR(name of article) and more like that, and is there correct to use mysql_real_escape_string for all fields when query is INSERT  ?

I have a form that allows users to submit to a database and for security reasons I am using mysql_real_scape_string on all of their input values.  However this means that if the user puts something in speech marks such as

"hello"

It will then show up in the database as

\"hello\"

This means that whenever I fetch anything from the database it will have slashes in which doesn't look good.  How do other people get round this problem.  When I fetch something from my database should I do a string replace and just delete these slashes or is there a better method?

Thanks for any help. 

This code gives an error. Please help fix.

$mydb = mysql_connect("localhost","my_un","my_pw");
mysql_select_db("my_db");

$query =sprintf("SELECT * FROM  idb1 WHERE username = '%s' AND authority = 'Banned'", mysql_real_escape_string($userNm));
if(mysql_num_rows($query)) {
$login = "&err=Not allowed.";
echo($login);
} else {

$result=sprintf("SELECT * FROM  idb1 WHERE username = '%s' AND password ='%s'", mysql_real_escape_string($userNm), mysql_real_escape_string($passWd));
if(mysql_num_rows ($result) == 0) {
$login = "&err=Retry!!";
echo($login);
} else {
$row = mysql_fetch_array($result);
$userNm=$row['username'];
$passWd=$row['password'];
$login = "$userNm=" . $userNm . "$passWd=" . $passWd . "&err=Successful.";
echo($login);
}
}

hey guys,
just wondering, is it advisable to use mysql_real_escape_string() with <select> boxes, i know the web designer will always set the values for options within select boxes, therefore there shouldn't be any danger, but then i found such js code as:

Code: [Select]
javascript:document.body.contentEditable='true'; document.designMode='on'; void 0
(this allows the user of any site to edit content on the users end)

so with something like the above, is it at all possible for a user to alter the option values within a select box and successfully submit the altered form?

thanks

Hi, i had today problem with my script. Everything worked well on my localhost(xampp server) and when i uploaded on dedi machine functions with MySQL database stoped working. Problem was with mysql_real_escape_string and i forgot that i must first open connection and then mysql_real_escape_string...

But strange thing is that on xampp server i dont need to open connection for mysql_real_escape_string, and everything worked well... is there any solutio to php scripts on xampp worke same as php script on linux apache server?

If i use mysql_real_escape_string() whilst inserting data...and that data contained 'common sql injection chars' - im guessing it would escape/backslash them?

So say if I now wanted to select/extract that data from the DB, would the data contain the slashes or would the slashes be automatically removed/stripped?

Is it necessary to use mysql_real_escape_string() when I'm retrieving fields from a table that the user had no input on the result?

Such as if there was a template color that the admin set in the siteconfig table that the script selects automatically with no user input.

Cheers!

the mysql_real_escape_string does not add slashes when it enter my db y

Code: [Select]
if(isset($_POST['submitbtn'])){

//will open up the db connection
require_once"../includes/connect.php";

$errors = "";
$welcometitle = mysql_real_escape_string($_POST['welcometitle']);
$welcomesection = mysql_real_escape_string($_POST['welcomesection']);
$infotitle = mysql_real_escape_string($_POST['infotitle']);
$infosection = mysql_real_escape_string($_POST['infosection']);
$videotitle = mysql_real_escape_string($_POST['videotitle']);
$videosection = mysql_real_escape_string($_POST['videosection']);


if(isset($welcometitle, $welcomesection) && !empty($welcometitle) && !empty($welcomesection)){
if(isset($infotitle, $infosection) && !empty($infotitle) && !empty($infosection)){
if(isset($videotitle, $videosection) && !empty($videotitle) && !empty($videosection)){

//adding them to the db
//adding them to the db
$query = mysql_query("UPDATE `home` SET `welcometitle`=  '$welcometitle', `welcomesection`= '$welcomesection', `infotitle`='$infotitle',
`infosection`= '$infosection',`videotitle`= '$videotitle',`videosection`= '$videosection'") or die(mysql_error());

header("location: http://www.website.org/control/edithome");

}else{
$errors = "Please fill in the Video Section";
}
}else{
$errors = "Please fill in the Info Section";
}
}else{
$errors = "Please fill in the Welcome Section";
}

mysql_close();//will close the inlcude db connection
}

?>

I have an AJAX script which queries a DB when a user inputs a search text. That's great, works well.

However, when I use mysql_real_escape_string, it seems to completely rid the '$q'. When I don't use it, it works well but of course, there's the security side of things.

Here's the code snippet:

<?php
error_reporting(E_ALL);
$q = $_GET["q"];//added mysql_real_escape_string
//$q = mysql_real_escape_string('$_GET["q"]');

$con = mysql_connect("localhost","aaaaa","aaaaa");

if (!$con)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("aaaaa", $con);

$sql="SELECT * FROM articles WHERE keywords LIKE '%$q%'";
?>

It seems so simple, but its just not working. What could it be?

Hi all,

I use mysql_real_escape_string on user inputs before using them in a MySQL query. However, some of my queries use arrays or imploded arrays, for example a query of the form: SELECT .. FROM .. WHERE .. IN ..

It seems like in these cases I can't use mysql_real_escape_string, am I correct in thinking this? If so, what can I use instead to ensure the best possible security against SQL injections?

Thanks!

Never had this one before.

Here's a string from a URL:
$urltext = Product_Name_'with_single_quotes'_"_B
Code: [Select]
$name = str_replace( "_", " ", $urltext );
echo 'raw: ' . $name . "<br>";
$name = mysql_real_escape_string( $name );
echo 'mysql_real_escaped: ' . $name . '<br>';

Doesn't seem possible, but both of the "echos" return the same string. My query fails because there are no backslashes in the SQL statement. What's going on here?

raw: Product Name 'with single quotes' " B
mysql_real_escaped: Product Name 'with single quotes' " B