Warning: mysql_real_escape_string (): access denied for user '' @ 'localhost' (using password: NO)

Question

When the following code is used without mysql_real_escape_string, it works fine. I'm just trying to grab a text string that may have an apost. from the input form and format it to put in mysql table.

<?php $filenamee = $_FILES["file"]["name"]; $filename =strval($filenamee); echo "file name is".$filename; $con=mysqli_connect("localhost","blasbott_admin","lubu1973","blasbott_upload"); // Check connection if (mysqli_connect_errno()) { echo "Failed to connect to MySQL: " . mysqli_connect_error(); } $companyName = mysql_real_escape_string($_POST['companyName']); // $companyName = mysql_real_escape_string($companyNamee); //$companyName = mysql_real_escape_string($companyNamee); $sql="INSERT INTO ads (companyName, webSite, picture) VALUES ('$companyName','$_POST[webSite]','$filename')"; if (!mysqli_query($con,$sql)) { die('Error: ' . mysqli_error($con)); } echo"<br>"; echo "1 record added"; mysqli_close($con); ?> 

Answer 1

You have a risk of injecting MySQL. Never insert data directly into a database without any projection. This is a serious security risk. Also use mysqli_real_escape_string and note that your $ _POST [website] is not secure.

In addition, your error means that your database data is incorrect.

Answer 2

No, you should not mix mysql and mysqli.

Use here instead of mysql_real_escape_string($var) :

 $con->real_escape_string($var); 

Answer 3

An example of working code that is the solution to this problem is available here:

http://www.w3schools.com/php/func_mysqli_real_escape_string.asp

Answer 4

Try mysqli_real_escape_string .

Answer 5

You must first connect to the database before using Warning: mysql_real_escape_string ()