| | |
Protecting against sql injections
Please support our MySQL advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
Thread Solved |
•
•
Join Date: Apr 2008
Posts: 41
Reputation:
Solved Threads: 1
I wonder if someone can point me in the right direction for securing my site more effectively.
Having experienced problems with Google warning pages being placed on my site relating to potential malware, I've been looking into "beefing up" security, but am find the tutorials relating to safeguarding against sql injections confusing.
The following is a sample of code on my site - is anyone willing to explain how I can improve the security for it?
Any advice would be greatly appreciated.
Having experienced problems with Google warning pages being placed on my site relating to potential malware, I've been looking into "beefing up" security, but am find the tutorials relating to safeguarding against sql injections confusing.
The following is a sample of code on my site - is anyone willing to explain how I can improve the security for it?
MySQL Syntax (Toggle Plain Text)
<div id="content"> <?php $user="*****"; $host="*****"; $password="*****"; $database="*****"; mysql_connect($host, $user, $password); mysql_select_db($database); ?> <?php if (!isset($_POST['submit'])) { ?> <form action="" method="post"> <table border="0" cellpadding="2" width="95%"> <tr> <td>Date:</td> <td><input type="text" size="10" name="date"></td> <td><b>YYYY-MM-DD format</td></b> </tr> <tr> <td>Ref:</td> <td><input type="text" size="2" name="ref"></td> <td><b> </td></b> </tr> <tr> <td>Card No:</td> <td><input type="text" size="2" name="cardno"></td> <td> </td> </tr> <tr> <td>Form:</td> <td><input type="text" size="7" name="form"></td> <td> </td> </tr> <tr> <td>Horse:</td> <td><input type="text" size="25" name="horse"></td> <td> </td> </tr> <tr> <td>Weight:</td> <td><input type="text" size="6" name="weight"></td> <td> </td> </tr> <tr> <td>Jockey:</td> <td><input type="text" size="25" name="jockey"></td> <td> </td> </tr> <tr> <td>Trainer:</td> <td><input type="text" size="25" name="trainer"></td> <td>Stable name</td> </tr> <tr> <td>Preview:</td> <td><textarea name="comment" rows="7" cols="35"></textarea></td> <td> </td> </tr> </table> <input type="submit" name="submit" value="Submit!"> </form> <?php } ELSE { $date = $_POST['date']; $ref = $_POST['ref']; $cardno = $_POST['cardno']; $form = $_POST['form']; $horse = $_POST['horse']; $weight = $_POST['weight']; $jockey = $_POST['jockey']; $trainer = $_POST['trainer']; $comment = $_POST['comment']; mysql_query("INSERT INTO `*****` (date, ref, cardno, form, horse, weight, jockey, trainer, comment) VALUES ('$date', '$ref', '$cardno', '$form', '$horse', '$weight', '$jockey', '$trainer', '$comment')"); echo "Success! This overview has been added to the database!"; } ?>
Any advice would be greatly appreciated.
![]() |
Other Threads in the MySQL Forum
- Previous Thread: Updating 12k records twice a day
- Next Thread: what is wrong with this code?
| Thread Tools | Search this Thread |
1 agplv3 alfresco amazon api artisticlicense aws bizspark breathalyzer camparingtocolumns cmg communityjournalism contentmanagement contractors copyright count court data database design developer development distinct drupal dui ec2 email enter enterprise error eudora facebook form foss gnu government gpl greenit groklaw hiring hyperic images innerjoins insert ip joebrockmeier join journalism keyword keywords kickfire law legal license licensing maintenance managing mariadb matchingcolumns metron micromanage microsoft microsoftexchange mindtouch montywidenius mozilla multiple music mysql mysqlcolumnupdating mysqldatetimeordermax() mysqlindex mysqlinternalqueries mysqlquery mysqlsearch news open-xchange opendatabasealliance opengovernment opensource oracle penelope php query referencedesign reorderingcolumns resultset saas select sharepoint simpledb sourcecode spotify sql sugarcrm syntax techsupport thunderbird transparency virtualization





