Question

Please don’t send me a link to php.net referencing mysql_real_escape_string as the only response. I have read through the page and while I understand the general concepts, I am having some trouble based on how my INSERT statement is currently built.

Today, I am using the following:

$sql = "INSERT INTO tablename VALUES ('', 
                                      '$_SESSION['Member1FirstName'], 
                                      '$_SESSION['Member1LastName'], 
                                      '$_SESSION['Member1ID'], 
                                      '$_SESSION['Member2FirstName'], 
                                      '$_SESSION['Member2LastName'], 
                                      '$_SESSION['Member2ID'] ....)

and the list goes on for 20+ members with some other values entered. It seems most people in the examples already have all their data stored in an array.

On my site, I accept form inputs, action=”” is set to self, php validation takes place and if validation passes, data is stored into SESSION variables on page 2 then redirected to the next page in the process (page 3) (approximately 8-10 pages in the whole process).

Answer 1

You seem to already know that you should be using mysql_real_escape_string but I guess you don’t know how to use. You need to apply it for each user supplied string you insert into your SQL. The following example should clarify this:

$sql = "INSERT INTO tablename VALUES ('', '" .
    mysql_real_escape_string($_SESSION['Member1FirstName']) . "', '" .
    mysql_real_escape_string($_SESSION['Member1LastName']) . "', '" .
    etc..

Or alternatively look into prepared statements and bind parameters for an easier (and faster) solution.