sql injection

[sudhakararaog]

i have implemented a way to avoid sql injection from the php website from this url

http://in.php.net/mysql_real_escape_string  from the "Example #3 A "Best Practice" query" section of this page

 

following are the steps i have followed after the form values are submitted to a php file.

 

step 1.

 

if(get_magic_quotes_gpc())

{

$username = stripslashes($_POST["username"]);

.........

}

 

else

{

$username = $_POST["username"];

.........

}

 

step 2.

 

$conn = mysql_connect($hostname, $user, $password);

 

step 3.

 

$insertquery = sprintf("INSERT INTO table (`username`, ...) VALUES ('%s', ...)", mysql_real_escape_string($username, $conn),

 

...);

 

step 4.

 

if(!$conn)

{

header("Location: http://website/dberror.html");

exit;

}

 

else

{

mysql_select_db($database, $conn);

 

$insertqueryresult = mysql_query($insertquery);     

 

 

if(!$insertqueryresult) {

header("Location: http://website/error.html");

exit;                 }   

 

}

 

with the above method i am able to insert values into the table even with if i enter the ' special character which can cause

 

problems.

 

i have also used a simple sql insert query like

 

$insertquery = "INSERT INTO table(username, ...) VALUES ('$username', ...)";

 

when i used this simple insert query and if i entered ' in the form and submitted the form the php file is unable to process

 

the information entered because of the ' character and as per the code error.html file is being displayed where as if i use

 

$insertquery = sprintf("INSERT INTO table (`username`, ...) VALUES ('%s', ...)", mysql_real_escape_string($username, $conn),

 

...);

 

even if i enter any number of ' characters in more than 1 form field data is being inserted into the table

 

a)

so i am thinking that the steps i have taken from the php site is correct and the right way to avoid sql injection though

 

there are several ways to avoid sql injection.

 

b)

for example if i enter data in the form as = abc'''def for name, the data in the table for the name field is being written as

 

abc'''def

 

based on how i have written the steps to avoid sql injection is this the right way for the data to be stored with '

 

characters along with the data example as i mentioned = abc'''def

 

please answer the questions a) and b) if there is something else i need to do please suggest what needs to be done exactly

 

and at which step.

 

any help will be greatly appreciated.

 

thanks.

 

[FlyingIsFun1217]

Please use code tags. There's a reason why they're there.

 

FlyingIsFun1217

[discomatt]

It's not that hard to navigate without the code tags.. quit being so nit-picky

 

It looks good. I believe your script is safe from most methods of injection. Data should be stored properly in your database.

[FlyingIsFun1217]

It's not that hard to navigate without the code tags

 

For who? It's known to be general practice if you want most people to look at it.

 

FlyingIsFun1217