index.php
PHP Code:
<html>
<body>
<form action="insert.php" method="post">
Firstname: <input type="text" name="firstname" />
Lastname: <input type="text" name="lastname" />
Age: <input type="text" name="age" />
<input type="submit" />
</form>
</body>
</html>
then insert.php
PHP Code:
<?php
function check_input($value)
{
// Stripslashes
if (get_magic_quotes_gpc())
{
$value = stripslashes($value);
}
// Quote if not a number
if (!is_numeric($value))
{
$value = "'" . mysql_real_escape_string($value) . "'";
}
return $value;
}
$con = mysql_connect("localhost", "root", "");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("injection", $con);
$fname = check_input($_POST['firstname']);
$lname = check_input($_POST['lastname']);
$age = check_input($_POST['age']);
$sql="INSERT INTO inject (FirstName, LastName, Age)
VALUES
($fname,$lname,$age)";
if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error());
}
echo "1 record added";
mysql_close($con)
?>
i use mysql_real_escape_string for the prevention..........is my code is ok? if ok then - when i paste in browser
PHP Code:
http://localhost/sql/insert.php?value=hacked
then it add value like this
anybody plz help me.....how to prevent it???? |
