0
1
Mitul Dabhi
answered Nov 30 '-1 00:00
escape string with mysql_real_escape_string () function
$sql=mysql_query("insert into #tablename values('".mysql_real_escape_string ($_REQUEST['skill'])."')")or die(mysql_error());
for php 7 , use Mysqli extension
$sql=mysqli_query("insert into #tablename values('".mysqli_real_escape_string ($_REQUEST['skill'])."')")or die(mysqli_error());
still not advisable to use input parameters directly like this . you should use some wrapper function or wrapper class which filter/validate/do security check to input before it to save
ok it worked for me , Thanks and how can i validate before it save ? -
ajamil
Oct 4 '16 07:17
0
jagdish
answered Nov 30 '-1 00:00
its Sql Injection .
you should escape the string before it to save in database .
0
shyam
answered Nov 30 '-1 00:00
its sql inejction you should filter input before it to save in database . its like cleaning fruit and veggies before pour in to stomach ,
use filter function to filter it , you have Validate or Sanitize or other filters
check it out if it help to code well
http://php.net/manual/en/function.filter-input.php
0
ravi
answered Nov 30 '-1 00:00
check this pls http://open-source-customization.com/question/how-to-avoid-sql-injection-in-php/98
- how to store serialized value to PostgreSQL in php
- Firebase : Is there any way where i can connect to Firebase database with Php scripts?
- how to use PHP substr() and strip_tags() ?
- Wordpress : how to check user logged in or not ?
- PHP: how use mysqli_escape_string in MVC?
- Setting namespace for stdClass object in PHP