I have very old php application and I am avoiding sql injection like this: Is this will avoid sql injection? &lt;?php $con = mysqli_connect($var['dbhost'],$var['dbuser'],$var['dbpass'],$var['dbname']);  $text = $con -&gt; real_escape_string(strip_tags(htmlspecialchars(trim(stripslashes($_POST['title']))))); $class = $con -&gt; real_escape_string(strip_tags(htmlspecialchars($_POST['class']))); $join_back = $con -&gt; real_escape_string(strip_tags(htmlspecialchars($_POST['join_back']))); $heading = $con -&gt; real_escape_string(strip_tags(htmlspecialchars($_POST['heading']))); $serial =  $con -&gt; real_escape_string(htmlentities(trim(addslashes($_REQUEST['serial']))));    $sql = &quot;INSERT INTO site_data(admin_id,site_id,page_id,css_name,serial,data_title,data_code,data_type,time_added,visible_for,join_back,is_deleted)  VALUES('&quot;.$uid.&quot;','&quot;.$sid.&quot;','&quot;.$pid.&quot;','&quot;.$class.&quot;','&quot;.$serial.&quot;','&quot;.$text.&quot;','&quot;.$html_data1.&quot;','text','&quot;.time().&quot;','all','','no')&quot;;   if(mysqli_query($con,$sql)) {      header(&quot;location: show_data.php&quot;); $db-&gt;close(); exit; } else { echo &quot;&lt;div style='border: 3px solid blue;margin:10px;padding:10px;' class='error' align='center'&gt;Problem Occurred. Try again Later.&lt;/div&gt;&quot;; } ?&gt;
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
$M$ = mass of the Sun  $m$ = mass of the Earth  $r$ = distance between the Earth and the Sun  The sun is converting mass into energy by nuclear fusion.   $$F = \frac{GMm}{r^2} = \frac{mv^2}{r} \rightarrow r = \frac{GM}{v^2}$$  $$\Delta E = \Delta M c^2 = (M_{t} - M_{t+\Delta t}) c^2 \rightarrow \Delta M = \Delta E / c^2$$  $$\rightarrow \frac{\Delta r}{\Delta t} = \frac{G}{v^2 c^2}.\frac{\Delta E}{\Delta t}$$  Sun radiates $3.9 × 10^{26}~\mathrm W = \Delta E/\Delta t$  Velocity of the earth $v = 29.8 \mathrm{km/s}$  There is nothing that is stopping the earth from moving with the same velocity so for centripetal force to balance gravitational force $r$ must change.   Is $r$ increasing? ($\Delta r/ \Delta t = 3.26070717 × 10^{-10} \mathrm{m/s} $) How do you remove a file whose filename begins with a dash (hyphen or minus) -?  I'm ssh'd into a remote OSX server and I have this file in my directory:  tohru:~ $ ls -l total 8 -rw-r--r--    1 me  staff  1352 Aug 18 14:33 --help ...   How in the world can I delete --help from a CLI?  This issue is something that I come across in different forms on occasion, these files are easy to create, but hard to get rid of.  I have tried using backslash  rm \-\-help   I have tried quotes  rm "--help"   How do I prevent the minus (dash or hyphen) character to be interpreted as an option? How can I view the Android internal partition table? I've rooted my device, put it in recovery mode, and have linked it to PC by .  How can I view the list of storage devices and partitions?  Note: fdisk doesn't work. Bounded measurable function and integral with charcteristic function Is it ok to answer based someone's older answer on SE? Possible Duplicate:             This question will probably be closed in a few minutes. It is a duplicate but I couldn't find the question using with meta search.  Anyway, , . In this case, is vote to close the new question as a possible dublicate not the best choice? Looks to me a little bit not ethical. What's this I hear about First Edition Unix being restored? that the source code of First Edition Unix had been restored from tapes.  The response was amazement and a request for more information.  What have people done?  Who did it?  When?  And how? How do I install pillow in Ubuntu 16.04 LTS? I recently decided to watch Doctor Who, and started viewing the 2005 version. I have the first two episodes from the first season, and I can't help but wonder what is the etymology of the name "Doctor Who"? And why does the protagonist call himself "the Doctor" (or is it "the doctor")? I just wanted to ask whether there is any command which would work on common shells (bash, dash, kornshell)? It is supposed to check if the line variable contains any part of the path.  if [[ $line =~ "$PWD"$ ]] ;then Why is AES unbreakable? In general, what is meant by saying that the fraction $x$ of the variance in an analysis like PCA is explained by the first principal component? Can someone explain this intuitively but also give a precise mathematical definition of what "variance explained" means in terms of principal component analysis (PCA)?  For simple linear regression, the r-squared of best fit line is always described as the proportion of the variance explained, but I am not sure what to make of that either. Is proportion of variance here just the extend of deviation of points from the best fit line? How would you explain covariance to someone who understands only the mean? ...assuming that I'm able to augment their knowledge about variance in an intuitive fashion (  ) or by saying: It's the average distance of the data values from the 'mean' - and since variance is in square units, we take the square root to keep the units same and that is called standard deviation.  Let's assume this much is articulated and (hopefully) understood by the 'receiver'. Now what is covariance and how would one explain it in simple English without the use of any mathematical terms/formulae? (I.e., intuitive explanation. ;)  Please note: I do know the formulae and the math behind the concept. I want to be able to 'explain' the same in an easy to understand fashion, without including the math; i.e., what does 'covariance' even mean? Detect browser language in Rails Why is "ask" sometimes pronounced "aks"? We've recently moved from New Zealand to New York City, and have noticed that many people (most of whom have good English) pronounce "ask" as "aks". For example:     Could you please go aks her tomorrow?   Sure, I'll ax her! :-)  What's the origin/etymology of "aks"? It seems to be more common among African Americans, but it's definitely used by others too. How do you open a command line? How do you access the command line or run option to put the commands into the system? I have Perl code which relies on Term::ReadKey to get the terminal width. My installation is missing this module, so I want to provide a default if the module isn't present rather than throw an exception. How can I conditionally use an optional module, without knowing ahead of time whether it is available. # but only if the module is installed and exists use Term::ReadKey; ...  How can I accomplish this? Interface naming in Java Most OO languages prefix their interface names with a capital I, why does Java not do this?  What was the rationale for not following this convention?  To demonstrate what I mean, if I wanted to have a User interface and a User implementation I'd have two choices in Java:        Class = User, Interface = UserInterface   Class = UserImpl, Interface = User      Where in most languages:     Class = User, Interface = IUser   Now, you might argue that you could always pick a most descriptive name for the user implementation and the problem goes away, but Java's pushing a POJO approach to things and   most IOC containers use DynamicProxies extensively.  These two things together mean that you'll have lots of interfaces with a single POJO implementation.  So, I guess my question boils down to: "Is it worth following the broader Interface naming convention especially in light of where Java Frameworks seem to be heading?" I'm reading the proof of the multiplicative property of $$s_k(n)=\sum_{d|(n,k)}f(d)g\bigg( \frac kd\bigg)$$ The book wrote that in order to understand the proof, we need to know if $a,b,k,m$ are integers such that $(a,k)=(b,m)=1$, then $$(ab,km)=(a,m)(b,k).$$  I have written proof, but I don't know is it consistent, and this seems used more tools than it necessarily has to.   My proof: Let $$S_1=\{d: d|(a,m), d&gt;0\}\\S_2=\{d: d|(b,k), d&gt;0\}\\S=\{d:d|(ab,km), d&gt;0\}.$$ I will prove the statement by showing that the function $\phi:S_1\times S_2\to S$ defined as $$\phi(d_1,d_2)=d_1d_2$$ is bijective, and complete the proof by connecting the maximal elements from these partial ordering sets.  Obviously, for $d_1\in S_1, d_2\in S_2$, this tells us $d_1 $ is both divisor of $a$ and $m$, and $d_2$ is both divisor of $b$ and $k$, hence $d_1d_2$ is both divisor of $ab$ and $km$, so we can tell $\phi(S_1\times S_2)\subseteq S$.  To show one-to-one, if we have $c_1,d_1\in S_1$ and $c_2,d_2\in S_2$ such that $$\phi(c_1,c_2)=\phi(d_1,d_2)$$ then $$c_1c_2=d_1d_2$$  In particular, $c_1|d_1d_2$, we need to show $c_1|d_1$. Indeed, if $(c_1,d_2)&gt;1$, this implies $a,k$ have common factor larger than $1$, contradicts the assumption. Therefore $c_1|d_1$. A similar argument implies $d_1|c_1$, therefore $c_1=d_1$. Again a similar argument implies $c_2=d_2$, which shows one-to-one.   To show onto, let $d\in S$, since $d|ab$, we can split $d$ into $d_1d_2$ such that $d_1|a$ and $d_2|b$. Since $(a,k)=1$, we see $(d_1,k)=1$, by property of $S$ we see also $d_1|m$, therefore $d_1\in S_1$, a similar argument implies $d_2\in S_2$. So every number in $S$ has a preimage in $S_1\times S_2$  This completes the proof. Is there any mistake in the proof?     Edit: A proof about the statement: If $d|ab$ then there are $d_1,d_2$ such that $d=d_1d_2$ and $d_1|a, d_2|b$.  Let $ab=p_1^{e_1}\cdots p_r^{e_r}$ for distinct prime factors $p_1,\cdots,p_r$, then we can write $$a=p_1^{x_1}\cdots p_r^{x_r}\\b=p_1^{y_1}\cdots p_r^{y_r}$$ where some of $x_i, y_i$ can be zero, and $x_i+y_i=e_i$ for all $i=1,\cdots,r$.  Since $d|ab$, we can write $$d=p_1^{f_1}\cdots p_r^{f_r}$$ with $f_i\leq e_i$ for all $i=1,\cdots,r$. Then since $$f_i\leq x_i+y_i$$ Split into two cases:   Case 1: $f_i&gt; x_i$, then we can choose $g_i=x_i$ and $h_i=f_i-x_i$.  Case 2: $f_i\leq x_i$, then we can choose $g_i=f_i$ and $h_i=0$.  Then the choice $$d_1=\prod_{i=1}^r p_i^{g_i}, \quad d_2=\prod_{i=1}^r p_i^{h_i}$$ will prove the statement. Are spells learned from feats considered to be associated with your class? The multiclassing spellcasting rules (PHB p. 164, or ) state:  Each spell you know and prepare is associated with one of your classes, and you use the spellcasting ability of that class when you cast the spell.  According to the above, every spell you know or prepare should be associated with a class.  However, for spells learned from feats like Drow High Magic or Wood Elf Magic are these actually associated with a class? If so, what class? If not, is the PHB statement above wrong/outdated? Are the spells learned in these feats (and others like it) associated with something else (like your race, in these cases)?  For reference, the  racial feat (XGtE p. 74) states:  You learn more of the magic typical of dark elves. You learn the detect magic spell and can cast it at will, without expending a spell slot. You also learn levitate and dispel magic, each of which you can cast once without expending a spell slot. You regain the ability to cast those two spells in this way when you finish a long rest. Charisma is your spellcasting ability for all three spells.  The  racial feat (XGtE p. 75) states:  You learn the magic of the primeval woods, which are revered and protected by your people. You learn one druid cantrip of your choice. You also learn the longstrider and pass without trace spells, each of which you can cast once without expending a spell slot. You regain the ability to cast these two spells in this way when you finish a long rest. Wisdom is your spellcasting ability for all three spells.  In regards to the third and fourth questions, the fact that the PHB quote says &quot;use the spellcasting ability of that class when you cast the spell&quot; and the fact that the feats specify what ability the spell uses in these examples (independent of class) suggests to me that they are not associated with class. What is the difference between #include  and #include "filename"?