Parameters for Protection:SQL Injection

[Spunky]

Based on my reading here: http://www.w3schools.com/sql/sql_injection.asp

 

I attempted to change:

$query= "INSERT INTO houses (location) VALUES ('$location)";mysql_query($query) or die(mysql_error());

(which works) into this:

$query= $dbh->prepare("INSERT INTO houses (location) VALUES (:loc)");$query->bindParam(':loc', $location);$query->execute();mysql_query($query) or die(mysql_error());

The code doesn't work. I am not sure if I translated correctly how to add "parameters" to the code to protect against SQL injection.

[Don E]

Try:

$query= $dbh->prepare("INSERT INTO houses (location) VALUES (?)");$query->bind_param('s', $location);$query->execute();

[Spunky]

 

Try:

$query= $dbh->prepare("INSERT INTO houses (location) VALUES (?)");$query->bind_param('s', $location);$query->execute();

 

Not working either.

[Don E]

Are you getting any errors? Try adding this to your code after execute() to see if you get any output: echo $dbh->error;

[dsonesuk]

mysqli uses bind_param(), PDO uses bindParam().

 

Which connection setup are you using? PDO or mysqli

 

http://www.w3schools.com/php/php_mysql_prepared_statements.asp

Edited December 28, 2014 by dsonesuk