How can I use mysql real escape line?

Question

The code here is still incomplete, because I'm still going to ask you which of the correct mysql escape string format / syntax is used. I am still new to php and I want to learn how to avoid sql injections. Is this code correct?

$con = mysql_connect("localhost","root","mypwd"); if (!$con) { die('Could not connect: ' . mysql_error()); } mysql_select_db("Hospital", $con); $sqlque="INSERT INTO t2 (HOSPNUM, ROOMNUM, ADATE, ADTIME, LASTNAME, FIRSTNAME, MIDNAME, CSTAT, AGE, BDAY, ADDRESS, TELNUM, SEX, STAT, STAT2, STAT3, STAT4, STAT5, STAT6, STAT7, STAT8, NURSE) VALUES ('$_POST[hnum]', '$_POST[rnum]', '$_POST[adate]', '$_POST[adtime]', '$_POST[lname]', '$_POST[fname]', '$_POST[mname]', '$_POST[cs]', '$_POST[age]', '$_POST[bday]', '$_POST[ad]', '$_POST[telnum]', '$_POST[sex]', '$_POST[stats1]', '$_POST[stats2]', '$_POST[stats3]', '$_POST[stats4]', '$_POST[stats5]', '$_POST[stats6]', '$_POST[stats7]', '$_POST[stats8]', '$_POST[nurse]')"; mysql_real_escape_string($_POST[hnum]), mysql_real_escape_string($_POST[rnum]); mysql_real_escape_string($_POST[adate]); 

Answer 1

You will need to avoid the values ​​before placing them in the query:

 $hnum = mysql_real_escape_string($_POST['hnum']); $query = "INSERT ... VALUES('$hnum')"; 

If you have many values, you can iterate over them:

 $values = $_POST; foreach ($values as &$value) { $value = mysql_real_escape_string($value); } $query = "INSERT ... VALUES('$values[hnum]')"; 

Answer 2

You use mysql_real_escape_string for AFTER variables, inserting them into a string!

You want to do

  $hnum = mysql_real_escape_string($_POST[hnum]), $rnum = mysql_real_escape_string($_POST[rnum]); $adate = mysql_real_escape_string($_POST[adate]); $sqlque="INSERT INTO t2 (HOSPNUM, ROOMNUM, ADATE, ADTIME, LASTNAME, FIRSTNAME, MIDNAME, CSTAT, AGE, BDAY, ADDRESS, TELNUM, SEX, STAT, STAT2, STAT3, STAT4, STAT5, STAT6, STAT7, STAT8, NURSE) VALUES ($hnum,$rnum,$adate', //etc. 

Even better, do not create SQL queries from string expansion at all. I suggest using PDOs and prepared statements / parameterized queries. A prepared expression takes care to avoid entering for you. Here's a good link outlining how to use PDO instead of mysql_ * commands.

Answer 3

you need to use this function as follows

 ....VALUES (".mysql_real_escape_string('$_POST[hnum]').",...