How can i secure this PHP script?

Question

Can anyone offer any suggestions on how to secure this PHP script from sql injection:

 <?php
include("config.php");
if(isset($_POST['lastmsg']))
{
$lastmsg = mysqli_real_escape_string($_GET['lastmsg']);
$result=mysql_query("select * from messages where msg_id<'$lastmsg' order by msg_id desc limit 9");
$count=mysql_num_rows($result);
while($row=mysql_fetch_array($result))
{
$msg_id=$row['ms_gid'];
$message=$row['message'];
?>



<li>[
<?php echo $message; ?>
</li>


<?php
}


?>

<div id="more<?php echo $msg_id; ?>" class="morebox">
<a href="#" id="<?php echo $msg_id; ?>" class="more">more</a>
</div>

<?php
}
?>

Thanks :)

is 'lastmsg' a POST or GET variable? You've referenced it two different ways. — Matt Bridges
– Matt Bridges, Commented Apr 15, 2011 at 19:26

Neil · Accepted Answer · 2011-04-15 21:13:59Z

4

$lastmsg = mysqli_real_escape_string($_GET['lastmsg']);

If you have access to mysqli you should use it in preference to mysql, because it allows you to bind parameters to statements thus bypassing SQL injection attacks. Sample code in procedural style:

$link = mysqli_connect();
$stmt = mysqli_stmt_init($link);
mysqli_stmt_prepare($stmt, "select * from messages where msg_id < ? order by msg_id desc limit 9");
mysqli_stmt_bind_param($stmt, "s", $_GET['lastmsg']);
mysqli_stmt_execute($stmt);
mysqli_stmt_store_result($stmt);
$count = mysqli_stmt_num_rows($stmt);

answered Apr 15, 2011 at 21:13

Neil

55.5k8 gold badges65 silver badges74 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Marc B · Accepted Answer · 2011-04-15 19:25:49Z

0

mysql_real_escape_string() is the only thing you need. Pass any value you're going to insert into the database through that first.

$someval = mysql_real_escape_string($someval);
$query = "SELECT ... WHERE field='$someval'";

answered Apr 15, 2011 at 19:25

Marc B

362k44 gold badges433 silver badges508 bronze badges

Collectives™ on Stack Overflow

How can i secure this PHP script?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related