SQL injection protection ERROR

Question

Am using the following code to protect SQL injection will this work

am using this in net beans am getting error in $_POST the error is do not access supergloab $_post directly how do i solve this WARNING MESSAGE

$place = mysql_real_escape_string($_POST['place']);
$product = mysql_real_escape_string($_POST['product']);
$type = mysql_real_escape_string($_POST['type']);
$title = mysql_real_escape_string($_POST['title']);
$detail = mysql_real_escape_string($_POST['detail']);
$mobilebrand = mysql_real_escape_string($_POST['mobilebrand']);
$mobilemodel = mysql_real_escape_string($_POST['mobilemodel']);
$mobilecond = mysql_real_escape_string($_POST['mobilecond']);
$price = mysql_real_escape_string($_POST['price']);
$location = mysql_real_escape_string($_POST['location']);
$description = mysql_real_escape_string($_POST['description']);
$youare = mysql_real_escape_string($_POST['youare']);
$name = mysql_real_escape_string($_POST['name']);
$email = mysql_real_escape_string($_POST['email']);
$phonenumber = mysql_real_escape_string($_POST['phonenumber']);

Try [Prepared statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) Or [PDO](http://php.net/manual/en/book.pdo.php). Also mysql extension is [deprecated](http://stackoverflow.com/questions/13944956) as of PHP 5.5.0, and will be removed in the future. — bansi, Sep 23 '14 at 16:09

score 2 · Accepted Answer · answered Sep 23 '14 at 16:09

2

Do it like this:

$place = filter_input(INPUT_POST, $_POST["place"]);
...

answered Sep 23 '14 at 16:09

Sergey6116

124
5

2

INPUT_POST what does it means – sanoj lawrence Sep 23 '14 at 16:11
It's the type of request, i.e. it means you are filtering a POST request. Here are the possible values: INPUT_GET, INPUT_POST, INPUT_COOKIE, INPUT_SERVER, INPUT_ENV – Sergey6116 Sep 23 '14 at 16:13
2

thank it was valuable – sanoj lawrence Sep 23 '14 at 16:17
1

and what does filte_input means – sanoj lawrence Sep 23 '14 at 16:19
It's PHP's function for getting values and filtering them. You can read about it here: http://www.w3schools.com/php/func_filter_input.asp – Sergey6116 Sep 23 '14 at 16:21
1

will that protect injection – sanoj lawrence Sep 23 '14 at 16:24
Yes it's made for that, it basically does the same as mysql_real_escape_string. – Sergey6116 Sep 23 '14 at 16:41

SQL injection protection ERROR

1 Answers1