Welcome to the Treehouse Community

Want to collaborate on code errors? Have bugs you need feedback on? Looking for an extra set of eyes on your latest project? Get support with fellow developers, designers, and programmers of all backgrounds and skill levels here with the Treehouse Community! While you're at it, check out some resources Treehouse students have shared here.

Looking to learn something new?

Treehouse offers a seven day free trial for new students. Get access to thousands of hours of content and join thousands of Treehouse students and alumni in the community today.

Start your free trial

PHP

Mayur Pande
PLUS
Mayur Pande
Courses Plus Student 11,711 Points
Posted by Mayur Pande
Mayur Pande
Courses Plus Student 11,711 Points

Filtering input, escaping output

I have an site that currently uses mysql procedural syntax. At the moment I use the spam bot check and honey pot check. However I don't seem to have any checks for required fields and for filter input.

My question is;

Is mysqli_real_escape_string() good enough for filtering input? Or have I got things confused?

1 Answer

Niels Anders
Niels Anders
7,408 Points
Niels Anders
Niels Anders
7,408 Points

Hi,

mysql_real_escape_string() make data safe before sending a query to MySQL. prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a.

Also that function protecting against SQL Injection Attacks.

But the function is not checking for required fields or user input. You must check before saving to Mysql.

For example you want to check a required field is not empty .

// if ($FirstName == '').... or if (empty($FirstName)) { $strError = "Fil in your Name"; }

echo $strError;

if there are no errors any more, other wise the error is not empty if (empty($strError)) { // save to database }

I hope it helps. Feel free te contact me