StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POWhere to use mysql_real_escape_string to prevent SQL Injection?
primarykey
Id
2312051
data
AcceptedAnswerId
2312064
AnswerCount
4
ClosedDate
CommentCount
3
CommunityOwnedDate
CreationDate
2010-02-22T15:50:01.660
FavoriteCount
3
LastActivityDate
2014-08-17T15:45:31.640
LastEditDate
2014-08-17T15:45:31.640
LastEditorUserId
3366929
OwnerUserId
150225
ParentId
0
PostTypeId
1
Score
12
ViewCount
14403
LastEditorDisplayName
text
Body
I'm in trouble with a group of hackers. they hacked my client's site few times, and my client gets more angry :( my client lost his database (which has hundreds records), and had to enter all :( now I'm following some more introductions; <ul> <li>fixed file permissions</li> <li>changed ftp and host login info</li> <li>cleared all remote mysql accesses</li> </ul> now working on SQL Injection issue. I added mysql_real_escape_string to admin panel login paramaters. So where else should I use this mysql_real_escape_string ? I have few email forms at site, I dont think i need to add there... I have an index.php as a mainpage. Should I do anything for this page to prevent any sql injection attack via url like <code>index.php?somesql=</code> ? Please advise me! I appreciate so much!!! :( <hr> for example: I have such code; <pre><code>public function showDetails($id) { // SQL Jobs Details $this->sql_job = "SELECT * FROM jobs WHERE id=".mysql_real_escape_string($id); $this->rst_job = mysql_query($this->sql_job); $this->row_all = mysql_fetch_assoc($this->rst_job); // SQL State $this->sql_state = "SELECT title FROM state WHERE id=" . $this->row_all[$this->tbl_jobs['f4']]; $this->rst_state = mysql_query($this->sql_state); $this->row_state = mysql_fetch_assoc($this->rst_state); ........ </code></pre> is it enough to use mysql_real_escape_string for $id . not for $this->row_all[$this->tbl_jobs['f4']] 
Tags
<php><mysql><security><sql-injection>
Title
Where to use mysql_real_escape_string to prevent SQL Injection?
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. This table or related slice is empty.
UserOwnerUserId
1. USdesigner-trying-coding
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
2. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
3. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
2. PO
 singulars
 PostTypePostTypeId
 PTAnswer
3. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POWhere to use mysql_real_escape_string to prevent SQL Injection?
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 POWhere to use mysql_real_escape_string to prevent SQL Injection?
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
3. VO
 singulars
 PostPostId
 POWhere to use mysql_real_escape_string to prevent SQL Injection?
 UserUserId
 USTim
 VoteTypeVoteTypeId
 VTFavorite
CommentsPostId

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.