Databases
StackOverflow2013
Postsdbo
POHow to use mysql_real_escape_string function in PHP
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow to use mysql_real_escape_string function in PHP
    primarykey
    data
    text
    <p>So in this program I'm writing, I actually grab a SQL query from the user using a form. I then go on to run that query on my database.</p> <p>I know not to "trust" user input, so I want to do sanitization on the input. I'm trying to use <code>mysql_real_escape_string</code> but have been unsuccessful in getting it to work.</p> <p>Here's what I'm trying, given the input: <code>select * from Actor;</code></p> <pre><code>//"query" is the input string: $clean_string = mysql_real_escape_string($query, $db_connection); $rs = mysql_query($clean_string, $db_connection); if (!$rs) { echo "Invalid input!"; } </code></pre> <p>This is ALWAYS giving me the</p> <blockquote> <p>"Invalid input!"</p> </blockquote> <p>error. </p> <p>When I take out the <code>clean_string</code> part and just run <code>mysql_query</code> on query, the </p> <blockquote> <p>"invalid input"</p> </blockquote> <p>message is not output. Rather, when I do this: </p> <pre><code>$rs = mysql_query($query, $db_connection); if (!$rs) { echo "Invalid input!"; } </code></pre> <p>It does NOT output</p> <blockquote> <p>"invalid input".</p> </blockquote> <p>However, I need to use the <code>mysql_real_escape_string</code> function. What am I doing wrong?</p> <p><strong>Update:</strong></p> <p>Given <code>select * from Actor;</code> as an input, I've found the following.</p> <p>Using echo statements I've found that before sanitizing, the string holds the value: <code>select * from Actor;</code> which is correct. However, after sanitizing it holds the incorrect value of <code>select *\r\nfrom Actor;</code>, hence the error message. Why is <code>mysql_real_escape_string</code> doing this? </p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USmuzaffar
    1. USCasey Patton
    plurals
    1. This table or related slice is empty.
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTDuplicate
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow to use mysql_real_escape_string function in PHP
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POHow to use mysql_real_escape_string function in PHP
      1. This table or related slice is empty.
      1. VTUpMod
    1. COI dont understand entering part... Are you grabbing **entire query** from user input or just some data to use later to generate query? I hope, that's not first case or you have serious problem with security.
      singulars
      1. POHow to use mysql_real_escape_string function in PHP
      1. USWh1T3h4Ck5
    2. COTry this tutorial http://net.tutsplus.com/tutorials/php/sanitize-and-validate-data-with-php-filters/
      singulars
      1. POHow to use mysql_real_escape_string function in PHP
      1. USalibenmessaoud
    3. COChang: echo "Invalid Input"; To this: die('Invalid Input: ' . mysql_error()); To see if you get a mysql error.
      singulars
      1. POHow to use mysql_real_escape_string function in PHP
      1. USk to the z
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload