Question

Another newbie here..
I’m trying to fix below code to prevent sql injection and learn the new way of writing php and sql.

Your kindly advise would be greatly appreciated.

I modified this

<?php

class DB_Functions {

    private $db;

    function __construct() {

        require_once 'db_connect.php';

        $this->db = new DB_Connect();
        $this->db->connect();
    }

    public function getUser($uid, $password) {
        $result = mysql_query("SELECT * FROM users WHERE id = '$uid' AND pswd = '$password'") or die(mysql_error());

        $no_of_rows = mysql_num_rows($result);

        if ($no_of_rows > 0) {

            $result = mysql_fetch_array($result);
            return $result;    

        } else {

            return false;
        }
    }
}

?>

to this and i don’t get the same result..

<?php

class DB_Functions {

    private $db;

    function __construct() {

        require_once 'db_connect.php';

        $this->db = new DB_Connect();
        $this->db->connect();
    }

    public function getUser($uid, $password) {
        $sql = $db->prepare("SELECT * FROM users WHERE id=:id AND pswd=:password");
        $result = $db->query($sql);
        $no_of_rows = mysql_num_rows($result);

        if ($no_of_rows > 0) {

            $result = mysql_fetch_array($result);
            return $result;    

        } else {

            return false;
        }
    }
}
?>

Answer 1

You can’t mix mysql with mysqli or PDO. You need to look at your error logs because this should not be possible – you should be seeing tons of fatal errors.

public function getUser($uid, $password) {
    $stmt = $db->prepare("SELECT * FROM users WHERE id=? AND pswd=?");
    $stmt->execute(array($uid, $password));
    return $stmt->fetch();
}