Thursday, 18 December 2014

How can I prevent SQL-injection in PHP [SOLVED]

How can I prevent SQL-injection in PHP [SOLVED]

Following are different 3 ways to prevent from SQL Injection.
1. Using PHP inbuilt Functions.
$name = mysql_real_escape_string($_POST["name"]);
mysql_query("INSERT INTO users VALUES($name)");


2. Use MySqli instead of MySQL. MySqli is far better than MySql because is object oriented MySql.
$stmt = $dbConnection->prepare('INSERT INTO users VALUES(?)');
$name=$_POST["name"];
$stmt->bind_param('s', $name);
$stmt->execute();


3. Using PDO
$stmt = $conn->prepare("INSERT INTO users VALUES(:name)");
$stmt->bindValue(':name', $_POST["name"]);
$stmt->execute();



Tuesday, 16 December 2014

get_class_vars PHP Function

array get_class_vars ( string $class_name )
Get the default properties of the class
Get the default properties of the given class.

<?phpclass myclass {

    var 
$var1// this has no default value...
    
var $var2 "xyz";
    var 
$var3 100;
    private 
$var4// PHP 5

    // constructor
    
function myclass() {
        
// change some properties
        
$this->var1 "foo";
        
$this->var2 "bar";
        return 
true;
    }

}
$my_class = new myclass();$class_vars get_class_vars(get_class($my_class));

foreach (
$class_vars as $name => $value) {
    echo 
"$name : $value\n";
}
?>


OOP PHP #16 : fungsi get_class_vars() dan get_class_method