DaniWeb Forum Index > Web Development > PHP

Sanitize PHP hidden form values

Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases

Thread Solved

•

Join Date: Sep 2009

Posts: 19

Reputation: davidjennings is an unknown quantity at this point

Solved Threads: 0

davidjennings davidjennings is offline

Offline

Newbie Poster

Sanitize PHP hidden form values

Sep 11th, 2009

Hi all, I am new to PHP

Do I need to sanitize hidden data values in a form before carrying out the query on MySQL db.

If so can someone assist me in the correct format

The category_id is an INT and the make is a String.

$category_id=$_POST['category_id'];
$make=$_POST['make'];

Also do I need to sanitize the query also

$result = mysql_query("SELECT * FROM products WHERE products_make ='$make'");

If you require any additional ifo please let me know.

Thanks in advance

David

Last edited by davidjennings; Sep 11th, 2009 at 6:22 am.

•

Join Date: Sep 2007

Posts: 1,514

Reputation: cwarn23 has a spectacular aura about

Solved Threads: 136

cwarn23

Offline

Posting Virtuoso

Re: Sanitize PHP hidden form values

Sep 11th, 2009

In future please use code tags as this is not your first post. Also the following code should do the trick:

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
$category_id=mysql_real_escape_string(stripslashes($_POST['category_id']));
$make=mysql_real_escape_string(stripslashes($_POST['make']));
$result = mysql_query("SELECT * FROM products WHERE products_make ='$make'") or die(mysql_error());
//or
$resultb = mysql_query("SELECT * FROM products WHERE products_make ='$make' AND id ='$category_id'") or die(mysql_error());
$category_id=mysql_real_escape_string(stripslashes($_POST['category_id']));
$make=mysql_real_escape_string(stripslashes($_POST['make']));
$result = mysql_query("SELECT * FROM products WHERE products_make ='$make'") or die(mysql_error());
//or
$resultb = mysql_query("SELECT * FROM products WHERE products_make ='$make' AND id ='$category_id'") or die(mysql_error());

Try not to bump 10 year old threads as it can be really annoying.
http://syntax.cwarn23.net/
Smilies: ^_* +_+ v_v -_- *~*`
My favourite PC. - MacGyver Fan

•

Join Date: Sep 2009

Posts: 19

Reputation: davidjennings is an unknown quantity at this point

Solved Threads: 0

davidjennings davidjennings is offline

Offline

Newbie Poster

Re: Sanitize PHP hidden form values

Sep 11th, 2009

Hi
Thanks for the information
working fine

Thanks for the heads up on the

Help with Code Tags

PHP Syntax (Toggle Plain Text)

 ****

rule and in the future I will add it to any further posts.

You mentioned my previous post which is not resolved, any ideas for a solution.

Thanks again

David

•

Originally Posted by cwarn23

In future please use code tags as this is not your first post. Also the following code should do the trick:
Help with Code Tags

php Syntax (Toggle Plain Text)
$category_id=mysql_real_escape_string(stripslashes($_POST['category_id']));
$make=mysql_real_escape_string(stripslashes($_POST['make']));
$result = mysql_query("SELECT * FROM products WHERE products_make ='$make'") or die(mysql_error());
//or
$resultb = mysql_query("SELECT * FROM products WHERE products_make ='$make' AND id ='$category_id'") or die(mysql_error());
$category_id=mysql_real_escape_string(stripslashes($_POST['category_id'])); $make=mysql_real_escape_string(stripslashes($_POST['make'])); $result = mysql_query("SELECT * FROM products WHERE products_make ='$make'") or die(mysql_error()); //or $resultb = mysql_query("SELECT * FROM products WHERE products_make ='$make' AND id ='$category_id'") or die(mysql_error());

•

Join Date: Sep 2007

Posts: 1,514

Reputation: cwarn23 has a spectacular aura about

Solved Threads: 136

cwarn23

Offline

Posting Virtuoso

Re: Sanitize PHP hidden form values

Sep 11th, 2009

•

You mentioned my previous post which is not resolved, any ideas for a solution.

What's the problem or is this solved?

Try not to bump 10 year old threads as it can be really annoying.
http://syntax.cwarn23.net/
Smilies: ^_* +_+ v_v -_- *~*`
My favourite PC. - MacGyver Fan

•

Join Date: Sep 2009

Posts: 19

Reputation: davidjennings is an unknown quantity at this point

Solved Threads: 0

davidjennings davidjennings is offline

Offline

Newbie Poster

Re: Sanitize PHP hidden form values

Sep 11th, 2009

Hi
This thread is solved and I will mark it accordingly

But do you have time to look at my previous thread

www.daniweb.co./forums/thread222004.html

Thanks in advance.

David