Question

I’m using a .Jquery autocomplete function and I’m tring to figure out where can put the mysql_real_escape_string() at. I’ve tried a few different ideas but I’m just not sure. I get an error of…

Warning: mysql_real_escape_string(): Access denied for user 'www-data'@'localhost'

When I use $ac_term = mysql_real_escape_string("%".$_GET['term']."%"); I’m not even sure if that the right way to use it.

Here’s what I have…

<?php
if (!isset($_SESSION)) {
  session_start();
} 


try {
  $conn = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
}
catch(PDOException $e) {
    echo $e->getMessage();
}

$return_arr = array();

if ($conn)
{
    $ac_term = "%".$_GET['term']."%"; 

    $query = "SELECT 

    CONCAT_WS('', '(',User_ID,') ', UserName, ' (',AccessLevel,')') AS DispName,
    User_ID, UserName, AccessLevel

    FROM Employees
    WHERE UserName LIKE :term
    OR User_ID LIKE :term
    OR AccessLevel LIKE :term

";

    $result = $conn->prepare($query);
    $result->bindValue(":term",$ac_term);
    $result->execute(); 

while ($row = $result->fetch(PDO::FETCH_ASSOC)) {

        $row_array['value'] = $row['DispName'];
        $row_array['User_ID'] = $row['User_ID'];    
        $row_array['UserName'] = $row['UserName'];
        $row_array['AccessLevel'] = $row['AccessLevel'];

        array_push($return_arr,$row_array);
    }

}
$conn = NULL;
echo json_encode($return_arr);
?>

Any suggestions?

Answer 1

You don’t have to add mysql_real_escape_string() to this query at all.
Just leave your code as is.