mysqli_real_escape_string with mysqli_num_rows in php

Question

My problem count sql .

<input name='d_n[]'> 
<input name='d_n[]'>

php page

post value Adam's

foreach($ds_director as $key => $director){
  // my problem here //
  $DnumSql = "SELECT * FROM list WHERE ds_name = ?";
  $stmt = $con -> prepare($DnumSql);
  $stmt -> bind_param('s',$director);
  $stmt -> execute();
  $Dnum = $stmt->num_rows;
  echo "$Dnum"; // result again '0'
  /////////////
  if($Dnum == 0){
      $director_sql = mysqli_real_escape_string($con,ucwords($director));
      $Dsql =  "INSERT INTO movie_ds (ds_m_name, ds_name, ds_status) VALUES ('$director_sql', '$m_name', 'yönetmen')";
      $Dquery = mysqli_query($con,$Dsql);

      if($Dquery){
        echo "<p style='color:green'>good</p>";
      }else{
        echo mysqli_error($con);
      }
}else{
     echo "<p style='color:red;'>not save</p>";
}
}

Because of this problem the same value is recorded

UPDATE PROBLEM editted = array input

Better use [bind_param](http://php.net/manual/en/mysqli-stmt.bind-param.php) for this — Saty, Jul 12 '16 at 11:18
[How can I prevent SQL-injection in PHP?](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — FirstOne, Jul 12 '16 at 11:38

score 1 · Answer 1 · answered Jul 12 '16 at 11:22

Better to use prepare statement for this. It will automatically escape your string and prevent from sql injection

$sql = 'SELECT * FROM list WHERE d_n =?';
$stmt =$con->prepare($sql);
$stmt->bind_param('s', $_POST['d_n']);
$stmt->execute();
$numrows = $stmt->num_rows;

mysqli_real_escape_string with mysqli_num_rows in php

1 Answers1