0

I wanting to check myself before I go live. I read so many different things on the internet but I want to know if this will absolutely protect my code for SQL Injection. If not, what do I need to add or take away?

$idtoapprove = mysql_real_escape_string($_POST['idtoapprove']);

$getcity = $conn->prepare('SELECT city, state FROM needs WHERE ID=:idtoapprove');
$getcity->bindParam(':idtoapprove', $idtoapprove);
$getcity->execute();

$cityrow = $getcity->fetch();
$needcity = $cityrow['city'];
$needstate = $cityrow['state'];

echo "$needcity, $needstate";

1 Answer 1

5

No need for mysql_real_escape_string here, actually, it's flat-out wrong (it's from a different, deprecated database library) and can damage your data. (Also, it would be ineffective here anyway - mysql_real_escape_string() is for escaping strings, it is useless for integers.)

The PDO prepared statement is enough.

2
  • You can even check if you really receive an ID, so INT > 0.
    – djot
    Sep 20, 2013 at 16:05
  • 2
    Just to explain further, mysql_real_escape_string will not work properly without an active database connection via the ext/mysql API which OP is unlikely to have. Using it would also escape the data twice. Sep 20, 2013 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.