Re: session variable in select query showing picture from database
| From: | Mika Jaaksi | Date: | Fri, 13 Feb 2009 07:01:37 +0000 |
| Subject: | Re: session variable in select query showing picture from database | ||
| References: | 1 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-45950@lists.php.net to get a copy of this message | ||
With these:
$band_id = $_SESSION['session_var'];
echo "band_id: " . $band_id;
$query="SELECT * FROM pic_upload WHERE band_id=$band_id";
echo "query: " . $query;
I get these:
band_id: 11
query: SELECT * FROM pic_upload WHERE band_id=11
SQL injections: Are these what I should use?
$db = new mysqli("localhost", "user", "pass", "database");
$stmt = $db -> prepare("SELECT priv FROM testUsers WHERE username=? AND
password=?");
$stmt -> bind_param("ss", $user, $pass);
$stmt -> execute();
And
$title = $_POST['title']; // user input from site
$dirtystuff = array("\"", "\\", "/", "*",
"'", "=", "-", "#", ";", "<",
">",
"+", "%"); // define the cleaner
// clean user input (if it finds any of the values above, it will replace it
with whatever is in the quotes - in this example, it replaces the value with
nothing)
$title = str_replace($dirtystuff, "", $title);
and should I add something like these everywhere where user can input data
into database?