PHP - Question On Mysql Injection

Hi all,

I thought instead of just simple do all the security stuff automatically, why not see for myself what the it can do.
So I made a simple table besides the other tables named delete_me,  made a form and started testing. But for some reason I can get that table to drop.

this is what i did on the front end with help from he http://en.wikipedia.org/wiki/SQL_injection

in all 3 fields (firstname, lastname email) put a value and in the last one i put:

but nothing happend.

if someone knows what i am doing wrong please tell me because I think it's vital in order to protect yourself one needs to know what he or she is up against.

Hey Guys!
I have the following Working php script (receives the variables from Flash)


//LOGIN!
if ($action == "login")
{
//retreive data from flash
$username=mysql_real_escape_string($_POST['Username']);
$password=mysql_real_escape_string($_POST['txtPassword']);


$result = mysql_query("SELECT name, activated from buyers WHERE email = '$username' AND password = md5('$password')");

$cant = 0; 
    while($row=mysql_fetch_array($result))
{
echo "name$cant=$row[name]&activated$cant=$row[activated]&"; 
        $cant++;
    } 
    echo "cant=$cant&";

if (mysql_num_rows($result) > 0) 
{
echo "status1=exists";
} 
else 
{
echo "status1=Incorrect Login";
}
}


As you can see I have used mysql_real_escape_string for the variables $username and $password that are coming from Flash.
I would really appreciate some guidence if this is the only safe code I need in this script?
For example: Does $action == "login" need also mysql_real_escape_string ??
That variable $action is also coming from flash (but is not inputted by a user)

Any ideas?
Thanks in advance,
Cheers!

i am using a Anti MySQL Injection my friend made for me

config.php
//Anti MySQL Injection
function anti_injection($sql) {
   // removes words that contain sql syntax
   $sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
   $sql = trim($sql); // strip whitespace
   $sql = strip_tags($sql); // strip HTML and PHP tags
   $sql = addslashes($sql); // quote string with slashes
   return $sql;
}

<?php 
include "./config.php";
$title = $_POST[title];
$type = $_POST[type];
$episode = $_POST[episode];
$year = $_POST[year];
$genre = $_POST[genre];
$status = $_POST[status];
$summary = $_POST[summary];
$pictures = $_POST[pictures];
$title = anti_injection($title);
$type = anti_injection($type);
$episode = anti_injection($episode);
$year = anti_injection($year);
$genre = anti_injection($genre);
$status = anti_injection($status);
$summary = anti_injection($summary);
$pictures = anti_injection($pictures); ?>
When i enter the data from the text box and click submit

it still puts the data in to the date base but it shows

]Notice: Use of undefined constant title - assumed 'title' in C:\wamp\www\studying\take 2\addin11.php on line 41

Notice: Use of undefined constant type - assumed 'type' in C:\wamp\www\studying\take 2\addin11.php on line 42

Notice: Use of undefined constant episode - assumed 'episode' in C:\wamp\www\studying\take 2\addin11.php on line 43

Notice: Use of undefined constant year - assumed 'year' in C:\wamp\www\studying\take 2\addin11.php on line 44

Notice: Use of undefined constant genre - assumed 'genre' in C:\wamp\www\studying\take 2\addin11.php on line 45

Notice: Use of undefined constant status - assumed 'status' in C:\wamp\www\studying\take 2\addin11.php on line 46

Notice: Use of undefined constant summary - assumed 'summary' in C:\wamp\www\studying\take 2\addin11.php on line 47

Notice: Use of undefined constant pictures - assumed 'pictures' in C:\wamp\www\studying\take 2\addin11.php on line 48

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

And thanks to the Anti MySQL Injection my Primary key in my database dont work :s
can you help? thank you

Does this code have mySQL Injection vulnerability?

$query = "DELETE FROM `$table` WHERE `$column` IN('".implode("','",$array)."')";

using php5, would this make the code more safe...

foreach($array as $key=>$a){
$array[$key] = mysql_real_escape_string($a);} 
$query = "DELETE FROM `$table` WHERE `$column` IN('".implode("','",$array)."')";

or is there another way to make the code safe?

Hello People,

Been reading up on these and trying to understand them more.  Say I have a file called page.php?id=12345

and when users hit the page I run this code in the background:


$id = $_GET['id'];
$query = "UPDATE tbl SET live = '1' WHERE id = '".$id."'"; 


That page is not open to any attack right?  Even though i'm using $_GET.

Am I right in thinking that attacks only happen on online forms.  So for example there is no way an attacker could somehow output all the data in my table tbl


Thank yo