note 74958 added to function.mysql-real-escape-string
| From: | brandonliraATgmailDOTcom at osu1 dot php dot net | Date: | Sun, 06 May 2007 10:09:59 +0000 |
| Subject: | note 74958 added to function.mysql-real-escape-string | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-126243@lists.php.net to get a copy of this message | ||
Quick update to example 1402.A, in the example no database is selected, and therefore the query
won't work right. Here is a updated version with the database selected. If anyone has any
thoughts on how to improve my selection method, please let me know.
<?php
if (isset($_POST['product_name']) &&
isset($_POST['product_description']) && isset($_POST['user_id'])) {
// Connect
$link = mysql_connect('mysql_host', 'mysql_user',
'mysql_password');
$select = mysql_select_db('mysql_name', $link);
if(!is_resource($link)) {
echo "Failed to connect to the server";
} elseif(!$select) {
echo "Failed to select database";
} else {
// Reverse magic_quotes_gpc/magic_quotes_sybase effects on those vars if ON.
if(get_magic_quotes_gpc()) {
if(ini_get('magic_quotes_sybase')) {
$product_name = str_replace("''", "'",
$_POST['product_name']);
$product_description = str_replace("''", "'",
$_POST['product_description']);
} else {
$product_name = stripslashes($_POST['product_name']);
$product_description = stripslashes($_POST['product_description']);
}
} else {
$product_name = $_POST['product_name'];
$product_description = $_POST['product_description'];
}
// Make a safe query
$query = sprintf("INSERT INTO products (
name, description,
user_id) VALUES ('%s', '%s', %d)",
mysql_real_escape_string($product_name, $link),
mysql_real_escape_string($product_description, $link),
$_POST['user_id']);
mysql_query($query, $link);
if (mysql_affected_rows($link) > 0) {
echo "Product inserted\n";
}
}
} else {
echo "Fill the form properly\n";
}
?>
Enjoy!
----
Server IP: 69.39.81.135
Probable Submitter: 70.115.226.167
----
Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php
Edit -- https://master.php.net/note/edit/74958
Del: integrated -- https://master.php.net/note/delete/74958/integrated
Del: useless -- https://master.php.net/note/delete/74958/useless
Del: bad code -- https://master.php.net/note/delete/74958/bad+code
Del: spam -- https://master.php.net/note/delete/74958/spam
Del: non-english -- https://master.php.net/note/delete/74958/non-english
Del: in docs -- https://master.php.net/note/delete/74958/in+docs
Del: other reasons-- https://master.php.net/note/delete/74958
Reject -- https://master.php.net/note/reject/74958
Search -- https://master.php.net/manage/user-notes.php