PHP DB - Re: [PHP-DB] PHP Beginners Help

Author

Re: [PHP-DB] PHP Beginners Help

Benjamin Darwin

2008-01-03, 3:59 am

Ben:

First, using a $_POST value directly into a MySQL query is EXTREMELY
unsafe. Always filter data from any source to make sure it's what you
expect. SQL injection is one of the easiest ways to cause real damage
to a website. http://en.wikipedia.org/wiki/SQL_injection

Check out this fuction for making the string safe:
http://us2.php.net/manual/en/functi...cape-string.php
Also, try and strip out any characters that don't belong in the string
anyway, just as added security.

Good luck learning PHP.

--Another person who happens to be named Ben

I've also put a few edits in the code.
On Jan 2, 2008 9:57 PM, Ben Stones <bastones@googlemail.com> wrote:
> Hello, my name is Ben Stones. I am quite a beginner to PHP, and as a new
> years resolution I am going to learn PHP (finally!)
>
> Cut to the chase I have created a basic looping script that would display
> anything submitted in a form, on seperate lines; here is the PHP code:
>
> $con = mysql_connect("localhost","ben_test","------removed-----") or
> die("con");
> $db = mysql_select_db("ben_test") or die("db");
> mysql_query("CREATE TABLE `comments` (messages varchar(255))");
> $comments = $_POST['comment'];
> $sql1 = mysql_query("INSERT INTO `comments` (`messages`) VALUES
> ($comments)");
>
> $mysql_query_one = mysql_query("SELECT * FROM `comments`");
> while($rows=mysql_fetch_array($mysql_que
ry_one)) {
> echo $rows['messages'] . "[br /]";
> }
>
> Everything went swell for the first half, and after I truncated the test
> messages (or everything in the column, if you like), I tried doing one more
> test run and upon clicking 'Submit', nothing would display except the
> messages I added via phpMyAdmin.
>
> Hope someone could help me.
>
> PS: The password has been edited out of the preceding code as well as the
> HTML code purposely for the mailing list.
>

Chris

2008-01-03, 3:59 am

Ben Stones wrote:
> Thanks all for your replies. Much appreciated. I have edited the code and
> took points into account:
>
>
> $con = mysql_connect("localhost","ben_test","removed") or die("con");
> $db = mysql_select_db("ben_test") or die("db");
> $sql1 = mysql_query("INSERT INTO `comments` (`messages`) VALUES
> ($comments)") or die("insert");
> $mysql_query_one = mysql_query("SELECT * FROM `comments`");
> while($rows=mysql_fetch_array($mysql_que
ry_one)) {
> echo $rows['messages'] . "[br /]";
>
> Okay, the browser outputted "insert" so it has to be something to do with
> the insert sql syntax I have added. Not sure if its over-riding the same
> content added as before or something.

It's dieing when you try to insert, probably because of quotes. As the
other Ben mentioned you need to escape the data.

Try:

$query = "INSERT INTO comments(messages) VALUES ('" .
mysql_real_escape_string($_POST['comment
s']) . "')";

$insert_result = mysql_query($query);

if (!$insert_result) {
echo "Error with insert: ", mysql_error(), "<br/>\n";
echo "Query I tried to run:<br/>\n", $query, "<br/>\n";
exit;
}

that way mysql will show you the error that occurred when you tried to
run the insert, and also you are escaping the comment you typed in so
things like quotes will be handled properly.

When you print the data out, you should use htmlspecialchars so if
someone enters javascript or any other 'bad' data it won't get printed
or executed.

For example:

$query = "SELECT * FROM comments";
$result = mysql_query($query);
while ($row = mysql_fetch_assoc($result)) {
echo "Comment was: ", htmlspecialchars($row['messages'], ENT_QUOTES),
"<br/>\n";
}

There's some good info available here about this sort of stuff:

http://phpsec.org/projects/guide/

If something doesn't make sense, send us another email :)

--
Postgresql & php tutorials
http://www.designmagick.com/

Sponsored Links