php - MySQLi query not working? Everything seems correct -


i have no idea why following code not work. of variables defined , yet doesnt work.

include('config.php'); $qid = $_get['newanswer']; $g_q_info = $con->query("select * questions id='$qid'"); $q_i = $g_q_info->fetch_object(); require_once 'htmlpurifier/library/htmlpurifier.auto.php'; $config = htmlpurifier_config::createdefault(); $purifier = new htmlpurifier($config); $content = $_post['editor1']; $content = $purifier->purify($content); $title = htmlspecialchars(strip_tags($_post['title'])); $questionid = $q_i->id; $con->query("insert answers (questionid,title,content) values ($questionid,$title,$contents)");

you have forgotten quote values you're inserting, , queries assuming success. on top of sql injection attack vulnerabilities in code. absolute bare minimum fix should soemthing like:

$con->query("insert a[..snip..]) values ('$questionid','$title','$contents')");                                               ^--         ^-^-- etc..

note additional quotes. won't fix larger injection problem, though.


Comments

Post a Comment

Popular posts from this blog

matlab - Deleting rows with specific rules -

i got 20*3 cell array , need delete rows contains "137", "2" , "n:t" origin data: 't' '' '' 'np(*)' '' '' [ 137] '' '' [ 2] '' '' 'are' 'and' 'np(fcc_a1#1)' '' '' '1:t' [ 1200] [0.7052] '' [1.2051e+03] [0.7076] '' 'are' 'and' 'np(fcc_a1#3)' '' '' '2:t' [ 1200] [0.0673] '' [1.2051e+03] [0.0671] '' 'are' 'and' 'np(m23c6)' '' '' '3:t' [ 1200] [0.227...
Read more

php - MySQLi multi_query results for later use -

i using mysqli multi_query work several select statemets @ time. know how handle results, able use them later in code. example: <?php //connection stuff $query = "select name, surname database1;"; $query.= "select car, year, type database2 carid='1';"; $query.= "select product, price database3;"; if ($mysqli->multi_query($query)) { if($result = $mysqli->store_result()) { while($row = $result->fetch_row()) { --> here? } } } ?> <html> <div id='persona'> <?php foreach() { --> print name + surname } ?> </div> <div id='cars'> <?php foreach() { --> print car + year + type } ?> </div> <div id='product'> <?php foreach() { --> print product + price } ?> </div> </html> one more thing, prepared statements not possible when using multiple_query, right? there no benefit in putting unrelated queries in 1 multi ...
Read more