note 74958 deleted from function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Sat, 14 Mar 2009 15:05:49 +0000 |
| Subject: | note 74958 deleted from function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-151924@lists.php.net to get a copy of this message | ||
Note Submitter: brandonlira AT gmail DOT com
----
Quick update to example 1402.A, in the example no database is selected, and therefore the query
won't work right. Here is a updated version with the database selected. If anyone has any
thoughts on how to improve my selection method, please let me know.
<?php
if (isset($_POST['product_name']) &&
isset($_POST['product_description']) && isset($_POST['user_id'])) {
// Connect
$link = mysql_connect('mysql_host', 'mysql_user',
'mysql_password');
$select = mysql_select_db('mysql_name', $link);
if(!is_resource($link)) {
echo "Failed to connect to the server";
} elseif(!$select) {
echo "Failed to select database";
} else {
// Reverse magic_quotes_gpc/magic_quotes_sybase effects on those vars if ON.
if(get_magic_quotes_gpc()) {
if(ini_get('magic_quotes_sybase')) {
$product_name = str_replace("''", "'",
$_POST['product_name']);
$product_description = str_replace("''", "'",
$_POST['product_description']);
} else {
$product_name = stripslashes($_POST['product_name']);
$product_description = stripslashes($_POST['product_description']);
}
} else {
$product_name = $_POST['product_name'];
$product_description = $_POST['product_description'];
}
// Make a safe query
$query = sprintf("INSERT INTO products (
name, description,
user_id) VALUES ('%s', '%s', %d)",
mysql_real_escape_string($product_name, $link),
mysql_real_escape_string($product_description, $link),
$_POST['user_id']);
mysql_query($query, $link);
if (mysql_affected_rows($link) > 0) {
echo "Product inserted\n";
}
}
} else {
echo "Fill the form properly\n";
}
?>
Enjoy!