Question

This is similar to a question I asked a while ago, however this didn’t seem to attract any answers so I’ll try again.

I have a booking system which you log into, and your username is stored in a cookie named $_COOKIE['ID_my_site']. I have a script which runs after a user has booked their flight which stores all the details into a table (named OABS_customers), which works fine, however the one row which doesn’t work is the username row, which adds $_COOKIE['ID_my_site'] into the row.

The table’s structure is the following:

Name         Type(Length)    Null     Default

name         varchar(60)     No       noname
address1     varchar(60)     No       noaddress
address2     varchar(60)     No       noaddress2
county       varchar(60)     No       nocounty
postcode     varchar(32)     No       nopostcode
customer     tinyint(4)      No       
seats        varchar(11)     No       0
number       tinyint(4)      No       0
class        varchar(11)     No       noclass
username     varchar(60)     No       nousername

So like I said, everything works fine but the username column, which just comes up with the default value of nousername. This is the code I am using;

$query = "INSERT INTO OABS_customers (username) VALUES ('$user')";

where $user = $_COOKIE['ID_my_site'] (defined before the above script).

If anyone could help out with this issue I would greatly appreciate it.

Answer 1

Never put unescaped, user generated strings into SQL queries. The cookies could be altered by some evil user and this leads to an SQL injection. Use mysql_real_escape_string($user) to escape the string.

Make sure that $_COOKIE['ID_my_site'] is not empty

mysql_query("INSERT INTO OABS_customers (username) VALUES ('". mysql_real_escape_string($user) ."')");