1

I need to know if this code works when a user update,insert or search for something in my database. I'm not familiar with mysqli_real_escape_string yet.

Do i need to use $_SESSION here if we're talking about user input ?

       $connmaj = new mysqli();

       if ($connmaj->connect_error) {
           die("Connection failed: " . $connmaj->connect_error);
       }    


   //select
            $titreItem = mysqli_real_escape_string($link, 
   $_REQUEST['TITRE_ITE']);
           $donateurIte = mysqli_real_escape_string($link, 
   $_REQUEST['DONATEUR_ITE']);
            $mntValeurIte = mysqli_real_escape_string($link, 
   $_REQUEST['MNT_VALEUR_ITE']);

            $sqlSelectItem = "select $titreIte, $donateurIte, 
   $mntValeurIte from TP2_ITEM where EST_ARCHIVEE_ENC != 'Archivé'";    

           if ($connmaj->query($sqlSelectItem) === TRUE) {
                echo "Succes";
            } else {
                echo "Error: Aucune information retrouvée." . 
              $connmaj- >error;
            }
// insert

$noItem =   mysqli_real_escape_string($link, $_REQUEST['NO_ITEM']);
        $noEncan = mysqli_real_escape_string($link, $_REQUEST['NO_ENCAN']);
        $noItemEncanItem = mysqli_real_escape_string($link, $_REQUEST['NO_ITEM_ENCAN_ITE']);
        $titreItem = mysqli_real_escape_string($link, $_REQUEST['TITRE_ITE']);
        $cheminPhotoIte = mysqli_real_escape_string($link, $_REQUEST['CHEMIN_PHOTO_ITE']);
        $descIte = mysqli_real_escape_string($link, $_REQUEST['DESC_ITE']);
        $donateurIte = mysqli_real_escape_string($link, $_REQUEST['DONATEUR_ITE']);
        $mntValeurIte = mysqli_real_escape_string($link, $_REQUEST['MNT_VALEUR_ITE']);
        $mntPrixDepartIte = mysqli_real_escape_string($link, $_REQUEST['MNT_PRIX_DEPART_ITE']);
        $mntIncrementMiniIte = mysqli_real_escape_string($link, $_REQUEST['MNT_INCREMENT_MINI_ITE']);
        $mntAchatImmediatIte = mysqli_real_escape_string($link, $_REQUEST['MNT_ACHAT_IMMEDIAT_ITE']);
        $estFermeIte = mysqli_real_escape_string($link, $_REQUEST['EST_FERME_ITE']);
        $estPayeIte = mysqli_real_escape_string($link, $_REQUEST['EST_PAYE_ITE']);

        $sqlInsertItem = "insert into TP2_ITEM values ('$noItem','$noEncan','$noItemEncanItem','$titreIte',
'$cheminPhotoIte','$descIte','$donateurIte','$mntValeurIte',
 '$mntPrixDepartIte','$mntIncrementMiniIte','$mntAchatImmedi .     atIte,'$estFermeIte','$estPayeIte')";


        if ($connmaj->query($sqlInsertItem) === TRUE) {
            echo "Insertion réussie";
        } else {
            echo "Clé primaire dupliquée" . $connmaj->error;
        }

Im excepting to return what the users enter in my application.

MT0
  • 143,790
  • 11
  • 59
  • 117
user9939473
  • 43
  • 6
  • `$_SESSION` holds information from the entire session. `$_REQUEST` is just the most recent request. Depends entirely where your data is stored. You should also not inject variables directly into the query! Use prepared statements! – Qirel Jul 18 '19 at 09:09
  • Why would i use prepared statements ? it is safer ? I'm just curious. Also, what do you mean by where my data is stored ? It's stored in a table in my DB. i'm assuming you know that soi dont know what you mean haha – user9939473 Jul 18 '19 at 09:13
  • Yes, much safer. And the queries become reusable. -- I mean that if the data you need is inside the `$_SESSION` global, then use that - if its in `$_GET`/`$_POST`, you can find it in `$_REQUEST`. So what to use depends on where you stored the data to begin with, before sending it to the database. – Qirel Jul 18 '19 at 09:14
  • Ah its possible its the same value, but id save a lot of time if i knew that to begin with, i see. – user9939473 Jul 18 '19 at 09:16
  • While i have you, do i need parameters on $connmaj = new mysqli(); Because my code is not returning any error when i run it but like i said i'm not familiar with PHP so i might get an error down the line, what do you think ? – user9939473 Jul 18 '19 at 09:18
  • If you correctly use prepared statements, not only you will be protected from SQL injection, but you will not have to use `mysqli_real_escape_string` – Dharman Jul 18 '19 at 12:27

1 Answers1

0

There is no connection between $_SESSION AND mysqli_real_escape_string Function.

mysqli_real_escape_string() function escapes special characters in a string for use in an SQL statement

Samir Patel
  • 167
  • 1
  • 7
  • Okay, i see. I can assume that what i programmed is fine ? Except that im not using prepared statement (yet). – user9939473 Jul 18 '19 at 09:28
  • Yes, exactly. If you have special characters in input like ' " & % etc. Then sql query can generate error. To prevent this mysqli_real_escape_string() function is used – Samir Patel Jul 18 '19 at 09:33