How can I protect this code from SQL Injection? A bit confused.
Posted
by Craig Whitley
on Stack Overflow
See other posts from Stack Overflow
or by Craig Whitley
Published on 2010-03-31T17:57:15Z
Indexed on
2010/03/31
18:03 UTC
Read the original article
Hit count: 313
I've read various sources but I'm unsure how to implement them into my code. I was wondering if somebody could give me a quick hand with it? Once I've been shown how to do it once in my code I'll be able to pick it up I think! This is from an AJAX autocomplete I found on the net, although I saw something to do with it being vulnerable to SQL Injection due to the '%$queryString%' or something? Any help really appreciated!
if ( isset( $_POST['queryString'] ) )
{
$queryString = $_POST['queryString'];
if ( strlen( $queryString ) > 0 )
{
$query = "SELECT game_title, game_id FROM games WHERE game_title LIKE '%$queryString%' || alt LIKE '%$queryString%' LIMIT 10";
$result = mysql_query( $query, $db ) or die( "There is an error in database please contact [email protected]" );
while ( $row = mysql_fetch_array( $result ) )
{
$game_id = $row['game_id'];
echo '<li onClick="fill(\'' . $row['game_title'] . '\',' . $game_id . ');">' . $row['game_title'] . '</li>';
}
}
}
© Stack Overflow or respective owner
