Search code examples
phpmysqlmysqlisql-injection

Is my code vulnerable to SQL injection?


I am creating a CMS but I do not know how to write the code to get saved from sql injection, Let me know if there is sql injection vulnerability in my code.

    if(isset($_POST['cout'])){

        $servername = "localhost";
        $username = "root";
        $password = "";
        $db = "bangla";
        $con = new mysqli($servername, $username, $password, $db);
        mysqli_query($con, "SET CHARACTER SET utf8");
        mysqli_query($con, "SET SESSION collation collation='utf8_general_ci'");

        $id = NULL;

        $name = $_POST['name'];
        $name = strip_tags($name);
        $name = htmlentities($name);
        $name = mysqli_real_escape_string($con, $name);

        $distrct = $_POST['distrct'];
        $distrct = strip_tags($distrct);
        $distrct = htmlentities($distrct);
        $distrct = mysqli_real_escape_string($con, $distrct);

        $division = $_POST['division'];
        $distrct = strip_tags($division);
        $distrct = htmlentities($division);
        $distrct = mysqli_real_escape_string($con, $division);

        $stmt = $con->prepare("INSERT INTO couts (id, name, distrct, division) VALUES( ?,?,?,?)");
        $stmt->bind_param('ssss', $id, $name, $distrct, $division);
        if($stmt->execute()){
            echo "New record created successfully";
        }
    }

Solution

  • You don't need strip_tags().

    You don't need htmlentities().

    You don't need mysqli_real_escape_string().

    Just use query parameters.