Question

i am trying escape some data before it goes into my database, but i keep getting this error:

Warning: mysql_real_escape_string(): Access denied for user 

Now this would usually suggest that i have not connected to the database (it also states (using password: NO)).

I was a little confused by this because when connecting to a database i have a ‘die’ clause so if it fails to connect i get told about it. So i tested this theory by running a simple query in the same function that im trying to escape the data and it works just fine.

So why on earth won’t the escape method work or get a connection to the database. I did notice that the user the error states is not the user i use to access the database its something like ‘www-data@localhost’. Could it be trying to log in with a different user, if so why and how? Because i another area of my website the escape function works just fine and i didn’t do anything special to make it work, just added the code into my web page.

thanks for the help.

Are there any other ways of sanitizing my code?

Okay, so here we go, when the user submits the form, i use AJAX to collect the data and put it into an obj to post(JSON encoding) it to the first PHP script which is here:

http://codepad.org/kGPljN4I

This script checks all the data is there and then calls a function to add it to the database

this Mysql class is called to escape the data and then add a new record to the database, when and instance of the class is made it makes a connection to the database:

http://codepad.org/wwGNrTJm

The third file is for constants, it holds the information for the database like pass, user and so on:

http://codepad.org/dl0QQbi9

any better?

thanks again for the help.

Answer 1

The problem is that you have established your connection using MySQLi, but are then calling mysql_real_escape_string(). You intend to be calling mysqli_real_escape_string() either in procedural context, or object oriented contex.

class Mysql 
{
    private $conn;

    function __construct() 
    {

        $this->conn = new mysqli(DB_SERVER, DB_USER, DB_PASSWORD, DB_NAME) or 
                      die('No Connection to database!');
    }

    function add_non_member($data) 
    {
        $email = $data->email;

            // Procedural call
            $san_email = mysqli_real_escape_string($this->conn, $email);

            // Or OO call (recommended)
            $san_email = $this->conn->real_escape_string($email);

                // etc...
        }

  // etc...;
}