Question

Possible Duplicate:
Best way to prevent SQL Injection in PHP

Is this code protected enough against sql injection

if(isset($_POST['Submit']))
{
$user = mysql_real_escape_string($_POST["user"]);
$pass = mysql_real_escape_string($_POST["pass"]);
$confirm_key=md5(uniqid(rand()));

$query = mysql_query("INSERT INTO members 
(user, pass, mail, confirm_key, country, city, www, credo)
VALUES  ('$user','$pass','$_POST[mail]','$confirm_key','$_POST[country]','$_POST[city]','$_POST[www]','$_POST[credo]')")
or die ("Error during INSERT INTO members:    " . mysql_error());
exit();
}

Is this the right way and must be each input (like country, city…) be protected ?

Answer 1

DO NOT USE mysql_query for new applications. You should be using mysqli or PDO to do your escaping with placeholders. There are many examples you can use.

Generally your SQL should look like:

INSERT INTO `table` (column) VALUES (?)

It SHOULD NOT look like:

INSERT INTO `table` (column) VALUES('$dangerous_user_content')

If you use placeholders properly it’s almost impossible to create a SQL injection hole.