Re: [PHP-DB] Re: session variable in select query showing picture from database

On Fri, Feb 13, 2009 at 6:01 PM, Mika Jaaksi <[email protected]> wrote:
> With these:
>
> $band_id = $_SESSION['session_var'];
> echo "band_id: " . $band_id;
>
> $query="SELECT * FROM pic_upload WHERE band_id=$band_id";
> echo "query: " . $query;
>
> I get these:
>
> band_id: 11
> query: SELECT * FROM pic_upload WHERE band_id=11
>
> SQL injections: Are these what I should use?
>
> $db = new mysqli("localhost", "user", "pass", "database");
> $stmt = $db -> prepare("SELECT priv FROM testUsers WHERE username=? AND
> password=?");
> $stmt -> bind_param("ss", $user, $pass);
> $stmt -> execute();

Yes.

> $title = $_POST['title']; // user input from site
>
> $dirtystuff = array("\"", "\\", "/", "*", "'", "=", "-", "#", ";", "<", ">",
> "+", "%"); // define the cleaner
>
> // clean user input (if it finds any of the values above, it will replace it
> with whatever is in the quotes - in this example, it replaces the value with
> nothing)

No. There's so many ways to get around that (use htmlentity values for example).

If you're not using bind params use mysql_real_escape_string().

-- 
Postgresql & php tutorials
http://www.designmagick.com/