php - Mysql real escape -


so using mysql_real_escape_string function stop sql injection attacks in following code doesn't seem working, how go fixing this?

<?php $address = mysql_real_escape_string($_post['bitcoinaddress']);  $btc = mysql_real_escape_string($_post['btcamount']);  $phone = mysql_real_escape_string($_post['phonenumber']);  $con = mysql_connect("localhost","db user","password"); if (!$con)   {   die('could not connect: ' . mysql_error());   }  mysql_select_db("db_name", $con); $sql="insert `db_name`.`form` (`bitcoinaddress`, `btcamount`, `phonenumber`) values ('$_post[bitcoinaddress]','$_post[btcamount]','$_post[phonenumber]')";  if (!mysql_query($sql,$con))   {   die('error: ' . mysql_error());   }   echo ($_post['btcamount']);   mysql_close($con); ?> 

the problem aren't using it...

make change.

<?php  $address = mysql_real_escape_string($_post['bitcoinaddress']);    $btc = mysql_real_escape_string($_post['btcamount']);    $phone = mysql_real_escape_string($_post['phonenumber']);    $con = mysql_connect("localhost","db user","password");  if (!$con)    {    die('could not connect: ' . mysql_error());    }    mysql_select_db("db_name", $con);  $sql="insert `db_name`.`form` (`bitcoinaddress`, `btcamount`, `phonenumber`) values  ('".$address."','".$btc."','".$phone."')";    if (!mysql_query($sql,$con))    {    die('error: ' . mysql_error());    }    echo ($btc);    mysql_close($con);  ?>


Comments

Popular posts from this blog

java - Plugin org.apache.maven.plugins:maven-install-plugin:2.4 or one of its dependencies could not be resolved -

Round ImageView Android -

How can I utilize Yahoo Weather API in android -