Hallo
Ich habe 2 MySQL Scripts und möchte mich dabei vor SQL-Injectoins schützen.
Ich hab auch 2 Links über diesem Thema, was ich jedoch nicht ganz verstehe:
http://phpforum.de/forum/showthread.php?t=218433
http://de.wikipedia.org/wiki/SQL-Injection#PHP
Was ich weiss, ist daß ich irgendetwas escapen soll ... nur was und wie genau scheint mich irgendwie zu irritieren.
So sehen meine Scripts aus:
Script1.php
PHP
<?php
if (!isset($_GET['id']) or empty($_GET['id'])) {
echo "Error: No Access";
}
else {
$id = $_GET['id'];
$db = mysql_connect('xxxx', 'xxxx', 'xxxx');
if (!db) {
die("Connection failed - Not able to connect to database: " . mysql_error());
}
$select = mysql_select_db("xxxx", $db);
if (!$select) {
die("Connection failed - Not able to connect to database: " . mysql_error());
}
$result = mysql_query("SELECT username,email FROM table WHERE id='$id'");
if (!$result) {
echo 'Connection failed: ' . mysql_error();
exit;
}
$row = mysql_fetch_assoc($result);
mysql_free_result($result);
if (!$row) {
echo "Error: No Access";
}
else {
// do stuffs
}
}
?>Script2.php
PHP
<?php
if (empty($_GET['username']) or empty($_GET['email']) or !isset($_GET['submit'])) {
echo "Please get back and fill in all fields.";
}
else {
$username = $_GET['username'];
$email = $_GET['email'];
$db = mysql_connect('xxxx', 'xxxx', 'xxxx');
if (!db) {
die("Connection failed - Not able to connect to database: " . mysql_error());
}
$select = mysql_select_db("xxxx", $db);
if (!$select) {
die("Connection failed - Not able to connect to database: " . mysql_error());
}
$test = "INSERT INTO table SET username = '$username', email = '$email'";
$result = mysql_query($test);
$id = mysql_insert_id();
echo $id;
}
?>