How to get data into MySQL with PHP?

[John Oliver]

I know absolutely nothing about this. I've been banging around various
tutorials. Most just sort of skip over this. The closest I came is:

http://www.freewebmasterhelp.com/tutorials/phpmysql/4

However, their example:

$query = "INSERT INTO contacts VALUES
('','$first','$ last','$phone', '$mobile','$fax ','$email','$we b')";

doesn't work, and got me a "Learn how to use SQL Injection" comment.

I need a tutorial that explains this stuff. I don't have the vaguest
clue what I'm doing, and when the tutorial assumes any pre-existing
knowledge, I get left behind pretty quickly.

--
* John Oliver http://www.john-oliver.net/ *
* Reform California gun laws - http://www.reformcagunlaws.com/ *
* http://www.gunownersca.com - http://www.crpa.org/ *
* San Diego shooters come to http://shooting.forsandiego.com/ *

[Kim André Akerø]

John Oliver wrote:

I know absolutely nothing about this. I've been banging around
various tutorials. Most just sort of skip over this. The closest I
came is:

http://www.freewebmasterhelp.com/tutorials/phpmysql/4

However, their example:

$query = "INSERT INTO contacts VALUES
('','$first','$ last','$phone', '$mobile','$fax ','$email','$we b')";

doesn't work, and got me a "Learn how to use SQL Injection" comment.

I need a tutorial that explains this stuff. I don't have the vaguest
clue what I'm doing, and when the tutorial assumes any pre-existing
knowledge, I get left behind pretty quickly.

The reason for the "Learn how to use SQL Injection" comments are
justified. If your server hosting has the magic_quotes_gp c setting in
PHP switched off, in addition to having register_global s switched on,
you'll be in trouble with the method above. Then I can delete your
entire address book by entering the following into one of the fields:

'); DELETE FROM contacts;

A better method would be something in the direction of the following:

<?php
// remove slashes for magic_quotes_gp c and injection attacks
$first = stripslashes($_ REQUEST["first"]);
$last = stripslashes($_ REQUEST["last"]);
$phone = stripslashes($_ REQUEST["phone"]);
$mobile = stripslashes($_ REQUEST["mobile"]);
$fax = stripslashes($_ REQUEST["fax"]);
$email = stripslashes($_ REQUEST["email"]);
$web = stripslashes($_ REQUEST["web"]);

// the following code is all on one line
$query = "INSERT INTO contacts VALUES
'','".mysql_rea l_escape_string ($first)."','". mysql_real_esca pe_string($l
ast)."','".mysq l_real_escape_s tring($phone)." ','".mysql_real _escape_stri
ng($mobile)."', '".mysql_real_e scape_string($f ax)."','".mysql _real_escape
_string($email) ."','".mysql_re al_escape_strin g($web)."')";

// execute the MySQL statement
mysql_query($qu ery);
?>

At least you'll be safer than using your original code. I know, it's a
lot more code, but it's also more secure.

Unfortunately, many tutorials out there teach the absolute simplest
way, which also teache the less secure methods.

--
Kim André Akerø
- ki******@NOSPAM betadome.com
(remove NOSPAM to contact me directly)