MySQL Real Escape String

[spinner0205]

I have never used real escape string so want to make sure I did it correctly. Also, if I can place it anywhere else to make it even more secure please let me know. This is just the action of a just a simple POST html form.

 

Here it is.

<?php
require ('staffarea/sql.php');
$showform="false";

$mcid = mysql_real_escape_string($_POST['mcid']);       
$age = mysql_real_escape_string($_POST['age']);
$description = mysql_real_escape_string($_POST['description']);

if(!mysql_query("INSERT INTO `somedatabase`.`appsubmissions` (`id`, `username`, `age`, `description`, `status`) VALUES (NULL, '$mcid', '$age', '$description', 'Pending');"))
{
echo '<div class=blockrow><b><font size=4>Submission Error</font><br /><br />Something went wrong. Contact Staff in the Support Forums and give them this information:<br /><br /></b><font color=red>';

echo mysql_error();

echo "</font>";

echo '<br /><br /><a href="/forumdisplay.php?f=14">Support Forums</a></div>';
}
else
{

$lastID=mysql_insert_id();

echo "<div class=blockrow><font size=3><b>$mcid, Thank You for your Building Application!</b></font><br /><br />";

echo "Your Unique Application ID: <b>", $lastID;

echo "</b> (save this so you can check the application status later)<br /><br />

Your application was submitted successfully. Please allow Staff 24 hours to accept or deny your application. If after 48 hours you still do not have building rights, assume the application was denied and re-submit with different information. DO NOT submit an application more than every 48 hours, doing so will get your account banned for spamming.<br /><br />

While waiting, you might check out the <a href=/index.php?pageid=mcguide>Ultimate Guide</a>.</div>";
}

mysql_close($con);

?>

[xyph]

Looks good. You need to escape or otherwise sanitize (ie: making sure a variable contains only numbers) any values that come from outside your script.

 

You should also escape any values you know to have quotes in them, as these could cause query errors or undesired results.

[WebStyles]

well, yeah... so far so good. basically you want to use mysql_real_eacape string before you insert, update or select stuff from a database, when the query is based on user input values.

[xyph]

Some additional reading:

http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html