I know that mysqli_real_escape_string Function can be used to prevent SQL injections. ( However, mysql_real_escape_string() will not protect you against some injections)  My question is when should I use mysqli_real_escape_string() function?  Situation 01   I have a registration form with 4 fields called First Name, Last Name, Email, Password.  Should I use mysqli_real_escape_string() to insert query also? All four fields?  Or is it enough to use in login form?  Situation 02  I have a profile page like profile.php?user_name=damith  I have used $_GET['user_name'] in many functions in this page.   Should I use mysqli_real_escape_string() in all those functions?
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
110595
I am trying to save multiple values from a textarea to a database table.  I use the following code, but I feel it is the wrong way.   foreach ($user_emails as $key =&gt; $value) {   $insert_banned_emails = db_insert('banned_users');   $insert_banned_emails     -&gt;fields(array(       'email' =&gt; $value,     ))     -&gt;execute(); }   Is there a different way for achieving the same result?
8186
is there an alternative for mysql_insert_id() php function for PostgreSQL? Most of the frameworks are solving the problem partially by finding the current value of the sequence used in the ID. However, there are times that the primary key is not a serial column....
112390
Is there a list describing all of the data_type parameters you can use in PDOStatement::bindParam() ? If none, what do you commonly use, and for what type of field ?  According to PHP manual: data_type Explicit data type for the parameter using the PDO::PARAM_* constants.   I know about the PDO::PARAM_INT and PDO::PARAM_STR . I've heard of PDO::PARAM_LOB but I wasn't sure how and when to use that, though. (for date ?)
34384
Since MySQL doesn't seem to have any 'boolean' data type, which data type do you 'abuse' for storing true/false information in MySQL?  Especially in the context of writing and reading from/to a PHP script.  Over time I have used and seen several approaches:   tinyint, varchar fields containing the values 0/1, varchar fields containing the strings '0'/'1' or 'true'/'false' and finally enum Fields containing the two options 'true'/'false'.   None of the above seems optimal. I tend to prefer the tinyint 0/1 variant, since automatic type conversion in PHP gives me boolean values rather simply.  So which data type do you use? Is there a type designed for boolean values which I have overlooked? Do you see any advantages/disadvantages by using one type or another?
47815
What is a strong way to protect against sql injection for a classic asp app?  FYI I am using it with an access DB.  (I didnt write the app)
43952
Which is the equivalent of mysql_data_seek using pdo objects? Can you give me an example?  Thanks!
7387
Can someone explain SQL injection?  How does it cause vulnerabilities?  Where exactly is the point where SQL is injected?
7271
Is it possible in PHP to do something like this? How would you go about writing a function? Here is an example. The order is the most important thing.  $customer['address'] = '123 fake st'; $customer['name'] = 'Tim'; $customer['dob'] = '12/08/1986'; $customer['dontSortMe'] = 'this value doesnt need to be sorted';   And I'd like to do something like   $properOrderedArray = sortArrayByArray($customer, array('name', 'dob', 'address'));   Because at the end I use a foreach() and they're not in the right order (because I append the values to a string which needs to be in the correct order and I don't know in advance all of the array keys/values).  I've looked through PHP's internal array functions but it seems you can only sort alphabetically or numerically.
69918
So I have an SQL dump file that needs to be loaded using mysql_query(). Unfortunately, it's not possible to execute multiple queries with it.  -> It cannot be assumed that the mysql command-line client (mysql --help) is installed -- for loading the SQL file directly  -> It cannot be assumed that the mysqli extension is installed  /* contents of dump.sql, including comments */ DELETE FROM t3 WHERE body = 'some text; with semicolons; scattered; throughout'; DELETE FROM t2 WHERE name = 'hello'; DELETE FROM t1 WHERE id = 1;   The explode() below won't work because some of the dump content's values contain semicolons.  $sql = explode(';', file_get_contents('dump.sql')); foreach ($sql as $key =&gt; $val) {     mysql_query($val); }   What's the best way to load the SQL without modifying the dump file?
20284
I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on the Internet for the most common SQL injections and try them out on my application?  I hope some guidance would be profitable for other newbies like me, so please, help me complete the following lists:   List of "places" in the application to be tested:   username  password(s)  e-mail search field  text fields any other fields that are available to the user  List of tests to be performed:   ...?    Thanks!
77056
I have configured my MySQL Database to require passwords on all users, even root from the machine itself.  Now I discovered that there are empty Users in my Database  Reproduce: mysql -u root -p and then use mysql; &amp; select * from user;  It gives me 2 entries, one with "localhost" and user &lt;empty&gt; and one with the machine's hostname and &lt;empty&gt;.  Now I tried to access the account with mysql -u ' ' (yes it's correct, leave a space between the ' things) and I log in without a password. The user can "only" see information_schema and test, the two databases created by default. He does not has access to mysql or any other custom created databases.  I already changed the Password of this user to something I won't tell you  mysql -u root -p use mysql; UPDATE mysql.user SET Password=PASSWORD('thisisasecretpassword') WHERE USER='root'; FLUSH PRIVILEGES;   Now my Questions:   Is any MySQL Server vulnerable for an attack with this entry? Could an attacker break out of this account or the two default databases? Should I password-protect those Users or can I delete them? Are They required for some MySQL-internal things?
27997
When a PHP application makes a database connection it of course generally needs to pass a login and password. If I'm using a single, minimum-permission login for my application, then the PHP needs to know that login and password somewhere. What is the best way to secure that password? It seems like just writing it in the PHP code isn't a good idea.
30885
In the PHP manual, to show the syntax for functions with optional parameters, they use brackets around each set of dependent optional parameter. For example, for the  function, the manual reads:  string date ( string $format [, int $timestamp = time() ] )   Where $timestamp is an optional parameter, and when left blank it defaults to the  function's return value.  How do you go about creating optional parameters like this when defining a custom function in PHP?
4465
Is there a measurable performance difference between using INT vs. VARCHAR as a primary key in MySQL? I'd like to use VARCHAR as the primary key for reference lists (think US States, Country Codes) and a coworker won't budge on the INT AUTO_INCREMENT as a primary key for all tables.   My argument, as detailed , is that the performance difference between INT and VARCHAR is negligible, since every INT foreign key reference will require a JOIN to make sense of the reference, a VARCHAR key will directly present the information.  So, does anyone have experience with this particular use-case and the performance concerns associated with it?
17694
I can read the MySQL documentation and it's pretty clear. But, how does one decide which character set to use? On what data does collation have an effect?  I'm asking for an explanation of the two and how to choose them.
18011
Is there a way to get the raw SQL string executed when calling PDOStatement::execute() on a prepared statement? For debugging purposes this would be extremely useful.