I'm making a database driven website and on some of the pages the content on the page changes depending on a variable in the URL. I'm using some code like this:

$var = isset($_GET['var'])?$_GET['var']:'default';
$query = 'SELECT tableCell from dataTable WHERE var =' . '"' . $var . '"';
$result = mysql_query($query);
$row = mysql_fetch_array($result, MYSQL_ASSOC);

//output data..

I'm not a very experienced PHP programmer, but I've heard about MySQL injections and other security problems and need advice. Do I need to do something to "secure" my code?

Thanks for your help

Read the stickied thread at the top of the forum.

Thanks for pointing me to the sticky topics. There are some really good articles in there.

So, just to make sure, all I need to do is use mysql_real_escape_string() on the "input" and then its safe to use in the MySQL query? Are there any other potential security problems I should be aware of?

Thanks a lot for your help!!

Nope, not enough. Have a look at http://www.tizag.com/mysqlTutorial/m...-injection.php for some more simple tricks.

Originally Posted by Learnin' n00b

Thanks for pointing me to the sticky topics. There are some really good articles in there.

So, just to make sure, all I need to do is use mysql_real_escape_string() on the "input" and then its safe to use in the MySQL query? Are there any other potential security problems I should be aware of?

Thanks a lot for your help!!

Yeah pretty much.
You can try to make it safe before hand just by sanitizing what data should be there..
For example,
if its an email address, Use the mysql escape and also check that the email is in an email format.

You then have two lines of defence.

Originally Posted by PaulW

Nope, not enough. Have a look at http://www.tizag.com/mysqlTutorial/m...-injection.php for some more simple tricks.

Tizag pretty much just says to use mysql escape.

$var = isset($_GET['var'])?$_GET['var']:'default';

$var = mysql_real_escape_string($var);
$query = 'SELECT tableCell from dataTable WHERE var =' . '"' . $var . '"';
$result = mysql_query($query);
$row = mysql_fetch_array($result, MYSQL_ASSOC);

Originally Posted by PaulW

Nope, not enough. Have a look at http://www.tizag.com/mysqlTutorial/m...-injection.php for some more simple tricks.

I don't understand, all that article says is to use mysql_real_escape_string(), right?