Codeigniter php: SQL injection prevent

Question

I've finished one application, but while developing haven't checked about sql injections and now at the end, i need to fix this little issue.

Here's my code, how could i on easiest way fix this to prevent sql injection (is there any function just to format my username, password parameters, not to change my code).

public function getArtistByUsernameByPassword($username, $password) {
    $query = $this->db->query("SELECT * FROM artists WHERE username = '$username' AND  password = ' $password'");
    if ($query->num_rows() > 0) {
        return $query->row_array();
    }
    return null;
}

Thanks in advance!

TheDrot · Accepted Answer · 2016-06-18 22:09:44Z

1

Use Codeigniter's query builder class.

So your code would look like this.

$query = $this->db->get_where('artists', array('username' => $username, 'password' => $password));

answered Jun 18, 2016 at 22:09

TheDrot

4,3381 gold badge18 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

William Knauss Over a year ago

A more "sugary" syntax would be $this->db->from->('artists')->where('username',$username)->where('password',$password)->get();

William Knauss Over a year ago

You may also want to add a limit to the query if this query is for authentication.

fatihn · Accepted Answer · 2016-06-18 22:07:03Z

0

Use db->escape() and db->escapestr() functions to avoid sql injection...

answered Jun 18, 2016 at 22:07

fatihn

1471 silver badge8 bronze badges

Collectives™ on Stack Overflow

Codeigniter php: SQL injection prevent

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related