PHP MySQL Injection threat.

[jamesmiddz]

Hi, can anyone tell me how I could prevent data injection into the following code?

<?php
include("connect.php");
$name = $_POST['name'];
$address = $_POST['address'];
$tel = $_POST['tel'];

$query = "INSERT INTO people (id, name, address, tel)
VALUES ('', '$name', '$address', '$tel')";

$results = mysql_query($query) or die
("Could not execute query : $query." . mysql_error());

if ($results)
{
echo "Details added.";
}
?>

James

[gerkintrigg]

Use get variables instead?

[jamesmiddz]

Hi gerkintrigg,

Thanks for the reply. The original strings data would be passed from a form. Would GET protect from data injections?

James

[effigy]

See MySQL's real_escape_string.

[jamesmiddz]

Thanks ;)

Most certainly will do.

James