Tutorial on how to prevent mysql injection using mysql function and php script from beginning to advance no PDO

To make sure what I’m saying is true, write a sentence like this.
Update z set a =a+1 ;
Then instead of a equal to one, it’s going to change to three, and that’s how if it’s worth three, it’s going to be worth five.

Write a full statement for me to be sure where to be targeting

1 Like

This is the code, just like I wrote in the procdure, but with the names changed only for privacy.
Begin
Update sin set wlk =wlk + 1
Where Id = Idss ;
Update sin set lhm=lhm + 1
where Id = Idss2 ;
END

And another example is when I insert someone’s information for the first time, the row is repeated twice.
And I solved this problem by making the email irreversible.

Okay try this…

first of all you may need to select the row you want to add first before updating…

BEGIN
DECLARE Firsts int(255) DEFAULT 0;
DECLARE Second int(255) DEFAULT 0;

SELECT columnname INTO Firsts FROM sin WHERE columnname = Idss;
SELECT columnname INTO Second FROM sin WHERE columnname = Idss2;

UPDATE sin SET wlk = firsts + 1 WHERE id = Idss;
UPDATE sin SET lhm = second + 1 WHERE id = Idss2;
END;

In summary you should first select the column you want to add before updating.

1 Like

I’ll try this, but you reminded me of something else when I order procdure and inside it, for example.
Declare idss int(255) ;
SELECT id into idss (Here’s the problem.) from sin where id =d(for example ) d is a Parameter
A message is returned that the funnction is wrong even though I originally requested procdure
I know I have a lot of problems with this script, but I hope your chest expands for me, and thank you for your help.

can you send the error message…and is it only procedure you have problem with

1 Like

yes, it was procdure, and I deleted it, so give some time to create a new one.

You need to trace the error…

whenever you create a function or procedure … first execute it in PhpMyAdmin If it works as expected then go to your app and do it… If it fails then the first problem is

  • The script is modifying the query…because of some regular expression

now if that is the case that your procedure is working in PhpMyAdmin but not from your app because of the script let me know i will chat you privately on what to change to your need

I don’t know what function means here.
I’ve also tried it without the word into and worked.


This picture has all the information.

okay this is from the script sorry for that let me quickly do it

but it was tested :frowning_face: i will need to do it again

1 Like

thank you anyway i don’t need this very much but i just wanted to inform you to be aware
doubt Thank you for this great script.

It’s not very important if it’s going to take a lot of time, don’t do it and save your time.

well according to mysql … it means the query does not return any row… so i just need to handle error very well in the script…

i will look into everything

Oh have seen your mistake

Like I told you earlier, if you’re going to take a lot of time, save your time and again, thank you.

according to your statement… you only select into a variable and it return no row.

you need this

Begin
Declare Varret Int(255);
Select admndwlk Into Varret from tablename where id = idss;
return Varret;
end;

You need to return if you are using function

but if is procedure you need this

Begin
Declare Varret Int(255);
Select admndwlk Into Varret from tablename where id = idss;
Select Varret;
end;

1 Like

You select the variable if you are using procedure

but you return a variable if you are using function

But as I told you earlier, this problem arises when I use procdure, not funnction.
And for the record, this sentence works in function normally.
But what made me hate function when I ask for example id, usernaem from within row I can’t do RETURN except id for example
I mean I couldn’t get the id and the username back together unfortunately

RETURN It’s only allowed in function.