PHP and MySQL - correct way to use mysqli_real_escape_string

Question

I was wondering if the code below is the correct way to use mysqli_real_escape_string() when storing users data in a database.

Here is the PHP & MySQL code.

if (mysqli_num_rows($dbc) == 0) {
        $mysqli = mysqli_connect("localhost", "root", "", "sitename");
        $dbc = mysqli_query($mysqli,"INSERT INTO info (user_id, url) 
                                     VALUES ('$user_id', 'mysqli_real_escape_string($url)')");
}


if ($dbc == TRUE) {
        $dbc = mysqli_query($mysqli,"UPDATE info 
                                     SET url = 'mysqli_real_escape_string($url)' 
                                     WHERE user_id = '$user_id'");

score 1 · Accepted Answer · 2010-04-02 01:11:20Z

1

No, mysqli_real_escape_string() is not executed within your string. You need to move it out into the PHP code:

$eUrl = mysqli_real_escape_string($url);
mysqli_query($mysqli, "INSERT ... VALUES ('$eUrl')");

But I (and, I'm sure, others here) will argue that PDO and variable binding are the "correct" way to escape things in this modern world.

edited Apr 2, 2010 at 1:11

answered Apr 1, 2010 at 17:07

user7675

Sign up to request clarification or add additional context in comments.

Comments

Pekka · Accepted Answer · 2010-04-01 17:06:12Z

0

Almost: You need to put the function calls outside the string:

"... VALUES ('$user_id', '".mysqli_real_escape_string($url)."')");

Notice the closing " and the concatenating . before and after the function call.

And, we don't know where $user_id comes from. If it comes from the outside, that needs to be escaped, too.

answered Apr 1, 2010 at 17:06

Pekka

451k150 gold badges989 silver badges1.1k bronze badges

Collectives™ on Stack Overflow

PHP and MySQL - correct way to use mysqli_real_escape_string

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related