How should I write PHP $_POST variable in a mysql_query function?

Question

Simple question. How do i make the query work? I know you can't directly use $_POST in a query. But i do not know how to get this to work.

$sql    = 'SELECT * FROM users WHERE `password` = $_POST[password] AND `username` = $_POST[username]';
$result = mysqli_query($link, $sql);

if (!$result) {
echo "DB Error, could not query the database\n";
echo 'MySQL Error: ' . mysqli_error($link);
exit;

I have also tried using the mysqli_real_escape_string like this :

    $username_sql = mysqli_real_escape_string($link, $_POST['username']);
    $password_sql = mysqli_real_escape_string($link, $_POST['password']);

This did not work as planned. As it did still not work.

Thanks,

Mike

As you're already using MySQLi, you should do it using prepared statements/bind variables.... you should not be injecting user-entered values directly into an SQL query string — Mark Baker
– Mark Baker, Commented Dec 1, 2015 at 10:22
And you certainly should not be storing plaintext passwords in your database.... use PHP's built-in password_hash()/password_verify().... learn the correct way to do this now, and you won't need to re-learn it again later — Mark Baker
– Mark Baker, Commented Dec 1, 2015 at 10:25
@mike - my point is that learning bad habits when you're just starting out, it's a lot harder to unlearn them and learn good habits later.... learning good habits (such as the use of prepared statements) now will stand you in better stead in the coming months/years — Mark Baker
– Mark Baker, Commented Dec 1, 2015 at 10:31

Abhishek Sharma · Accepted Answer · 2015-12-01 10:22:43Z

5

use '' with string comparison of MySQL

$username_sql = mysqli_real_escape_string($link, $_POST['username']);
$password_sql = mysqli_real_escape_string($link, $_POST['password']);

$sql = "SELECT * FROM users 
WHERE `password` = '$username_sql' AND `username` = '$password_sql'";

answered Dec 1, 2015 at 10:22

Abhishek Sharma

6,6241 gold badge17 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

mike Over a year ago

Thanks, this works. Would you mind telling me what i did wrong? So i will not make this mistake anymore.

Abhishek Sharma Over a year ago

use '' with string comparison of MySQL @mike

Abhishek Sharma Over a year ago

if my answer helps you please accept my answer @mike

Yuri Blanc Over a year ago

I suggest to use prepared statements

rray · Accepted Answer · 2015-12-01 10:33:50Z

4

Use prepared statements to avoid sql injection and syntax errors with commas .

$sql    = 'SELECT * FROM users WHERE `password` = ? AND `username` = ?';

$stmt = mysqli_stmt_init($link);
mysqli_stmt_prepare($stmt, $sql);
mysqli_stmt_bind_param($stmt, "ss", $_POST['password'], $_POST['username']);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

while($row = mysqli_fetch_assoc($result){
    echo $row['username'] .'<br>';
}

answered Dec 1, 2015 at 10:33

rray

2,5461 gold badge30 silver badges38 bronze badges

Comments

martinstoeckli · Accepted Answer · 2015-12-01 10:43:26Z

4

I think it is necessary to add at least one example of prepared statements, just to show that it is not more difficult and it makes your application safer (SQL-injection).

$stmt = $mysqli->prepare('SELECT * FROM users WHERE `password` = ? AND `username` = ?');
$stmt->bind_param("ss", $_POST[password], $_POST[username]);
$stmt->execute();
$stmt->bind_result($result);
$stmt->fetch();
// read the result...
$stmt->close();

Be aware that passwords should not be stored plain text, instead one should use the functions password_hash() and password_verify().

answered Dec 1, 2015 at 10:43

martinstoeckli

24.2k7 gold badges63 silver badges92 bronze badges

Comments

KiwiJuicer · Accepted Answer · 2015-12-01 10:23:48Z

0

You answered your question yourself. mysqli_real_escape_string() is the way to go.

$sql    = 'SELECT * FROM users WHERE `password` = "' . mysqli_real_escape_string($_POST[password]) . '" AND `username` = "' . mysqli_real_escape_string($_POST[username]') . '"';

answered Dec 1, 2015 at 10:23

KiwiJuicer

1,9721 gold badge14 silver badges29 bronze badges

1 Comment

Mark Baker Over a year ago

mysqli_real_escape_string() hasn't been the way to go for a long while, prepared statements/bind variables are the way to go

Collectives™ on Stack Overflow

How should I write PHP $_POST variable in a mysql_query function?

4 Answers 4

4 Comments

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

4 Comments

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related