php - Mysql real escape -
so using mysql_real_escape_string
function stop sql injection attacks in following code doesn't seem working, how go fixing this?
<?php $address = mysql_real_escape_string($_post['bitcoinaddress']); $btc = mysql_real_escape_string($_post['btcamount']); $phone = mysql_real_escape_string($_post['phonenumber']); $con = mysql_connect("localhost","db user","password"); if (!$con) { die('could not connect: ' . mysql_error()); } mysql_select_db("db_name", $con); $sql="insert `db_name`.`form` (`bitcoinaddress`, `btcamount`, `phonenumber`) values ('$_post[bitcoinaddress]','$_post[btcamount]','$_post[phonenumber]')"; if (!mysql_query($sql,$con)) { die('error: ' . mysql_error()); } echo ($_post['btcamount']); mysql_close($con); ?>
the problem aren't using it...
make change.
<?php $address = mysql_real_escape_string($_post['bitcoinaddress']); $btc = mysql_real_escape_string($_post['btcamount']); $phone = mysql_real_escape_string($_post['phonenumber']); $con = mysql_connect("localhost","db user","password"); if (!$con) { die('could not connect: ' . mysql_error()); } mysql_select_db("db_name", $con); $sql="insert `db_name`.`form` (`bitcoinaddress`, `btcamount`, `phonenumber`) values ('".$address."','".$btc."','".$phone."')"; if (!mysql_query($sql,$con)) { die('error: ' . mysql_error()); } echo ($btc); mysql_close($con); ?>
Comments
Post a Comment