This site has me all paranoid about SQL injection as far as I can notice this search has prepared statements and is MSQLI but could still be injectable  thanks  &lt;?php  $searchTerm = trim($_GET['keyname']);  if($searchTerm == "") {     echo "Enter name you are searching for.";     exit(); }  $host = "localhost"; $db = "DB"; $user = "user"; $pwd = "pass";  $link = mysqli_connect($host, $user, $pwd, $db);  $query = "SELECT * FROM TABLE WHERE Name LIKE '%$searchTerm%'";  $results = mysqli_query($link, $query);   if(mysqli_num_rows($results) &gt;= 1) {     $output = "";     while($row = mysqli_fetch_array($results))     {  echo "&lt;td align='center' width='60'&gt;" . "&lt;a href=\"{$row['page']}\"&gt;&lt;img src=\"{$row['img']}\"&gt;" ."&lt;/td&gt;";     }     echo $output; } else     echo "There was no matching record for the name " . $searchTerm; ?&gt;
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
23809
How do I escape the underscore character?  I am writing something like the following where clause and want to be able to find actual entries with _d at the end.  Where Username Like '%_d'
52772
I know how to map a list to a string:  foostring = ",".join( map(str, list_of_ids) )   And I know that I can use the following to get that string into an IN clause:  cursor.execute("DELETE FROM foo.bar WHERE baz IN ('%s')" % (foostring))   What I need is to accomplish the same thing SAFELY (avoiding SQL injection) using MySQLDB. In the above example because foostring is not passed as an argument to execute, it is vulnerable. I also have to quote and escape outside of the mysql library.   (There is a , but the answers listed there either do not work for MySQLDB or are vulnerable to SQL injection.)
44862
I have a problem binding booleans using mysqli_stmt::bind_param in PHP5. The SQL query is the following: insert into `nvp_notes` (subject,messageid,receivedate,read) values (?,?,?,?)  Where 'read' is a tinyint, either 0 or 1, as I've had issues with bit using mysqli. So the types that I list in bind_param are: $stmt-&gt;bind_param('sdsd', ...);  I've also tried 'sdsb' and 'sdss' but nothing seems to work, and I always get the message:  Warning: mysqli_stmt::bind_param(): Number of variables doesn't match number of parameters in prepared statement  When I remove the read field in the statement everything works fine. I've run out of ideas with this one. Surely bind_param works with booleans?
40449
I'm creating an installation script for an application that I'm developing and need to create databases dynamically from within PHP. I've got it to create the database but now I need to load in several .sql files. I had planned to open the file and mysql_query it a line at a time - until I looked at the schema files and realised they aren't just one query per line.  So, how do I load an sql file from within PHP (as phpMyAdmin does with its import command)?
42660
I am testing my application I need some code that stable simulates the deadlock on database site (sql script if possible).  Thank you.  ADDED:
111744
Say I have a table called User_FriendList, which has the following characteristics:  CREATE TABLE User_FriendList (     ID ...,     User_ID...,     FriendList_IDs...,     CONSTRAINT User_Friendlist_PK PRIMARY KEY (ID) );   And let us suppose that said table holds the following data:    +----+---------+---------------------------+  | ID | User_ID | Friendlist_IDs            |  +----+---------+---------------------------+  | 1  | 102     | 2:15:66:35:26:17:         |  +----+---------+---------------------------+  | 2  | 114     | 1:12:63:33:24:16:102      |  +----+---------+---------------------------+  | 3  | 117     | 6:24:52:61:23:90:97:118   |  +----+---------+---------------------------+   Note: The “:” (colon) is the delimiter when exploding in PHP into an array.  Questions  So:   Is this a convenient way to “store” the IDs of a FriendList? Or, instead, should I have individual rows with only one single FriendId value in each of them and, when I need to retrieve all the rows of a given list, simply perform a query like SELECT * FROM UserFriendList WHERE UserId = 1?
13602
I'm looking for the alternative of mysql_real_escape_string() for SQL Server. Is addslashes() my best option or there is another alternative function that can be used?  An alternative for mysql_error() would also be useful.
96046
I am having a few issues when people are trying to access a MySQL database and they are trying to update tables with the same information.  I have a webpage written using PHP. In this webpage is a query to check if certain data has been entered into the database. If the data hasn't, then i proceed to insert it. The trouble is that if two people try at the same time, the check might say the data has not been entered yet but when the insert takes place it has been by the other person.  What is the best way to handle this scenario? Can i lock the database to only process my queries first then anothers?
91251
Should question, or answers for that matter, with SQL Injection or other security issues be down voted?    I lean towards down voting them, so if in the future someone finds the question, the number of down votes may lead them to question the validity of the question.
56382
I’m using the listings package for code listings. Now I try to highlight some part of the code using \hl from the soul package.  Here’s an example of a resulting query where the injected part of a SQL injection should be highlighted:  \begin{lstlisting}[escapechar=@,language=SQL] SELECT name, password FROM users WHERE name='@\hl{' UNION SELECT "10", 1 \#}@'; \end{lstlisting}   But inside the highlighted part the SQL syntax highlighting is not applied.  So I tried to use \lstlinline for the code part inside \hl as well but it didn’t work:  \begin{lstlisting}[escapechar=@,language=SQL] SELECT name, password FROM users WHERE name='@\hl{\lstinline[language=SQL]$' UNION SELECT "10", 1 #$}@'; \end{lstlisting}   Although this \lstinline part works outside the lstlisting block, it doesn’t work inside it. The error I get for that particular line is:     Extra }, or forgotten \endgroup.   Maybe I’m just missing just some special syntax to get this working. Or is it not possible at all to get proper syntax highlighting for the \hl-highlighted part as well?
34791
This is the announcement post of the Stack Exchange Data Explorer. Its answers were meant to iron out the initial glitches 6 to 8 years ago.  If you have found a bug or need support  today with any of SEDEs features, please ask a new question and tag it with   What does it do? Allows you to run arbitrary SQL queries on the data dumps, and share those queries with your friends. Technical details It is hosted on the Stack Exchange infrastructure , the database is hosted on the same SQL Server version all other sites are hosted on. You can use most of the TSQL commands, even create temporary objects (but not User Defined Functions). The controls used are jQuery based, the grid is  . All query results are cached, so sharing a link to a query will not result in the server going in to a tailspin. The query edit control is a slightly modified  control, I also am considering bespin cause the inter iframe communication is nasty complicated. It gives up nice syntax highlighting for queries. Parameters There is support for parameterized queries, to get it to work name your params like ##this##. For example have a . Query name and description A query can have a name and description, to name it lead with a comment, to describe it continue commenting, for example: -- This is my query name  -- This is my description -- I can span multiple lines  SELECT 1  Anonymous users can initially name a query, but can not change the names of any existing queries. Tutorial There's a  which helps you getting started in writing your own SQL queries. Logging in You can use your openid provider to log in, at the moment once logged in we will track the list of queries you execute (giving you basic history support) Also if there are any params named UserId they will be populated automatically if your EmailHash matches the one on the site being queried. Magic columns If you alias an id column with as [Post Link] it will automatically create a link in the result set to the parent site. Similarly if you alias an id column with as [User Link] it will display a link to the user page. select top 10 * from Posts will show you how tags are done. (Magic columns for images is planned) example (most controversial posts:  ) So what are you waiting for, check it out at  Any feedback would be greatly appreciated. I hope to have the login section working fairly soon and allow voting on the best queries and commenting. Featured Queries At the moment, admins have permission to feature interesting queries on this page , I am looking for better ways to manage the huge query list that is building up.
47815
What is a strong way to protect against sql injection for a classic asp app?  FYI I am using it with an access DB.  (I didnt write the app)
5230
Here's my attempt at it:  $query = $database-&gt;prepare('SELECT * FROM table WHERE column LIKE "?%"');  $query-&gt;execute(array('value'));  while ($results = $query-&gt;fetch())  {     echo $results['column']; }
6749
What are the best workarounds for using a SQL IN clause with instances of java.sql.PreparedStatement, which is not supported for multiple values due to SQL injection attack security issues: One ? placeholder represents one value, rather than a list of values.  Consider the following SQL statement:  SELECT my_column FROM my_table where search_column IN (?)   Using preparedStatement.setString( 1, "'A', 'B', 'C'" ); is essentially a non-working attempt at a workaround of the reasons for using ? in the first place.    What workarounds are available?
91753
In a mysqli prepared statement, a NULL gets turned into '' (in the case of a string) or 0 (in the case of an integer). I would like to store it as a true NULL.  Is there any way of doing this?
6735
I've got a working PHP script that gets Longitude and Latitude values and then inputs them into a MySQL query. I'd like to make it solely MySQL. Here's my current PHP Code:  if ($distance != "Any" &amp;&amp; $customer_zip != "") { //get the great circle distance      //get the origin zip code info     $zip_sql = "SELECT * FROM zip_code WHERE zip_code = '$customer_zip'";     $result = mysql_query($zip_sql);     $row = mysql_fetch_array($result);     $origin_lat = $row['lat'];     $origin_lon = $row['lon'];      //get the range     $lat_range = $distance/69.172;     $lon_range = abs($distance/(cos($details[0]) * 69.172));     $min_lat = number_format($origin_lat - $lat_range, "4", ".", "");     $max_lat = number_format($origin_lat + $lat_range, "4", ".", "");     $min_lon = number_format($origin_lon - $lon_range, "4", ".", "");     $max_lon = number_format($origin_lon + $lon_range, "4", ".", "");     $sql .= "lat BETWEEN '$min_lat' AND '$max_lat' AND lon BETWEEN '$min_lon' AND '$max_lon' AND ";     }   Does anyone know how to make this entirely MySQL? I've browsed the Internet a bit but most of the literature on it is pretty confusing.