Been doing Mysqli & PHP for 2 weeks now and I like it! However....you start to try things and after a while, even if it works...you start to read about things like sql injection etc...My goal is to create a databases for small shops etc...with login etc...It doesn't mather how big the client is...it has to be safe! So my question: Am i doing it good? This is the HTML<!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <title>title</title> <link rel="stylesheet" href="style.css"> <script src="script.js"></script> </head> <body> <form action="homes.php" method="POST"> <p>Zoek: <input type="text" name="search" /></p> <p>Voornaam: <input type="text" name="Voornaam" /></p> <p>Achternaam: <input type="text" name="Achternaam" /></p> <p>Adres: <input type="text" name="Adres" /></p> <p>Discipline: <input type="text" name="Discipline" value="1 tot 5" /></p> <p>Bevestig zoeken: <input type="submit" name="Submit" /></p> <p>Voeg toe aan databank <input type="submit" name="Add_DB" value="Add to Database" /></p> </form> <?php require_once 'isset.php'; ?> </body></html>
This is the PHP<?php require_once 'login.php'; $dbcon = mysqli_connect($db_host, $db_username, $db_password, $db_database); if(mysqli_connect_errno()) die ("Error during connection"); if(isset($_POST['Submit'])){ $Naam = $_POST['search']; $Result = mysqli_query($dbcon,"SELECT * FROM customers WHERE Voornaam = '$Naam'"); if(!$Result) die ("Nothing to show"); $Rows = $Result->num_rows; for($i=0; $i < $Rows; $i++){ $Row = mysqli_fetch_array($Result, MYSQLI_ASSOC); echo "Voornaam: " . $Row['Voornaam'] . "<br>"; echo "Achternaam: " . $Row['Achternaam'] . "<br>"; echo "Adres: " . $Row['Adres'] . "<br>"; echo "<hr>"; } } if(isset($_POST['Add_DB'])){ $sql="INSERT INTO customers(Voornaam, Achternaam, Adres, Actief, Discipline) VALUES(?,?,?,NOW(),?)"; if($stmt = $dbcon->prepare($sql)){ $stmt->bind_param('sssi', $Voornaam, $Achternaam, $Adres, $Discipline); $Voornaam = $_POST['Voornaam']; $Achternaam = $_POST['Voornaam']; $Adres = $_POST['Adres']; $Discipline = $_POST['Discipline']; $stmt->execute(); echo "New records created successfully";} } mysqli_close($dbcon);?>Its spaghetti code most likely but i try to keep things organized...Its just that i'm learning this now and i'm like, hey would this work...i try it and it does....but i don't like bad practice!
Am i safe against sql injection?
Posted - 2014-12-15 : 11:52:11
