PHP MySQLi prepared statement for SELECT (avoid SQL Injection)

Question

is this the correct way to avoid SQL Injection in this SELECT?

// --[  Method  ]---------------------------------------------------------------
//
//  - Purpose   : Check if provided $email (taken from user input) exists in the DB
//
// -----------------------------------------------------------------------------
function DB_EmailExists($email)
{
    //
    if(DB_Connect() == false)
    {
        echo mysqli_error();
        return false;
    }

    //
    $stmt = $GLOBALS['global_db_link']->prepare("SELECT * FROM ".$GLOBALS['global_db_table_users']." WHERE Email=?");
    $stmt->bind_param('s', $email);
    $stmt->execute();
    $stmt->store_result();
    $numrows = $stmt->num_rows;
    $stmt->close();

    //
    if ($numrows==0)
    {
        DB_Disconnect();
        return false;
    }

    //
    DB_Disconnect();

    return true;
}

Almost. I would strongly suggest that you do NOT use $GLOBALS like that. Inject the database into this class, and call it directly ($this->db_link->prepare(....) — random_user_name
– random_user_name, Commented Nov 28, 2015 at 21:40
1) why downvoted? 2) why not use $GLOBALS like that, any explanation ? — PeeS
– PeeS, Commented Nov 28, 2015 at 21:48
Didn't downvote. And there's plenty of resources on why $GLOBALS is not good: stackoverflow.com/questions/1557787/… and stackoverflow.com/questions/12445972/stop-using-global-in-php and stackoverflow.com/questions/8715897/… and tomnomnom.com/posts/… and many others.... — random_user_name
– random_user_name, Commented Nov 28, 2015 at 21:53

VIDesignz · Accepted Answer · 2015-11-28 21:41:10Z

1

Yes, that works. But no need to SELECT *, just use SELECT email

answered Nov 28, 2015 at 21:41

VIDesignz

4,8133 gold badges30 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

PeeS Over a year ago

Perfect, i have added re-captcha to ensure no 'bot' is submitting the POST too.

random_user_name Over a year ago

@Pees - captchas are not foolproof, and they are bad for user experience. It's better to use other techniques to prevent bots. stackoverflow.com/a/13158804/870729 as well as using a nonce: stackoverflow.com/questions/4145531/…

VIDesignz Over a year ago

@cale_b Google's no-captcha is pretty legit though.

Collectives™ on Stack Overflow

PHP MySQLi prepared statement for SELECT (avoid SQL Injection)

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related