PHP - GetSQLValueString Function

Question

I see the GetSQLValueString function, and I don’t know what it is connected with, can someone give me some idea?
thank you

function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") { $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue; $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue); switch ($theType) { case "text": $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; break; case "long": case "int": $theValue = ($theValue != "") ? intval($theValue) : "NULL"; break; case "double": $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL"; break; case "date": $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; break; case "defined": $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue; break; } return $theValue; } 

Function Used Here:

 if (isset($_POST['username'])) { $loginUsername=$_POST['username']; $password=$_POST['password']; $MM_fldUserAuthorization = ""; $MM_redirectLoginSuccess = "main.php"; $MM_redirectLoginFailed = "login_form.php"; $MM_redirecttoReferrer = false; mysql_select_db($database_connection1, $connection1); $LoginRS__query=sprintf("SELECT username, password FROM member WHERE username=%s AND password=%s", GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); ... 

Answer 1

Your function escapes the string using MySQL's built-in string output function, and then if it's a non-numeric value, surrounding it in single quotes. This function was written to insert variable data into SQL queries.

 $sql = "SELECT * FROM users WHERE username = " . GetSQLValueString($_GET['username'], 'text'); $result = mysql_query($sql); 

Answer 2

In my opinion, this function probably avoids some data in order to pass it to MySQL. The function also processes null values ​​and optionally places some quotation marks.

it should be used in this way

 GetSQLValueString("a value that I want to escape's", 'text'); 

see SQL injection problem to see why this function exists

Answer 3

This function returns a specific row of data of a data type. This is used to avoid sql injection.

Answer 4

I think your problem is related to mysqli_ problem. You need to change all mysql _ to mysqli _ and add the database connection as the first parameter. In my case, the database connection is $ conn_vote . Keep in mind that I added the $ conn parameter as a function parameter:

  function GetSQLValueString($conn_vote, $theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") { $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue; $theValue = function_exists("mysqli_real_escape_string") ? mysqli_real_escape_string($conn_vote, $theValue) : mysqli_escape_string($conn_vote, $theValue);`enter code here` switch ($theType) { case "text": $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; break; case "long": case "int": $theValue = ($theValue != "") ? intval($theValue) : "NULL"; break; case "double": $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL"; break; case "date": $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; break; case "defined": $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue; break; } return $theValue; } } 

`