d7my11/alwaleed — pull request #1 by xiongchiamiov (2013-05-11 22:29:53+00:00)
Title: Prevent SQL Injection attacks by using parameterized queries

Use mysqli instead of mysql.

The [old mysql extension][0] is deprecated as of PHP 5.5.0; the official
recommendation is [to use either mysqli or PDO][1].

While PDO has a number of useful features, including an abstraction layer that
supports multiple database engines, mysqli has an extremely similar API to
mysql, and thus is trivial to switch to.

The impetus for this change is [mysqli's prepared statements][2]. These are much
nicer to use than either mysql_escape_string() or mysql_real_escape_string().

P.S. I tried my best to get git to stop mucking about with line endings, and
just leave them how they came. I wasn't completely successful, but now
everything should be consistent, at least.

[0]: http://www.php.net/manual/en/intro.mysql.php
[1]: http://www.php.net/manual/en/mysqlinfo.api.choosing.php
[2]: http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php

----

Use prepared statements to prevent SQL injection.

[SQL Injection][0] is one of the most common web application vulnerabilities,
in which an attacker is able to execute arbitrary queries on your database.
Any time you directly use user input in a query, you are vulnerable to SQL
injection.

For a humorous explanation, see [xkcd's Exploits of a Mom][1] and [this
explanation][2] of the comic.

There are [many ways][3] to prevent SQL injection in PHP. I chose the most
direct transition - from mysql to mysqli with prepared statements.

This is a public service provided by [The Programmer Education Foundation][4],
an organization of volunteers seeking to educate fellow developers about common
critical, but easily-correctable, errors.

[0]: http://en.wikipedia.org/wiki/Sql_injection
[1]: http://xkcd.com/327/
[2]: http://bobby-tables.com/about.html
[3]: http://bobby-tables.com/php.html
[4]: http://programmer-education-foundation.github.io/