PHP Get Data From Firebird

my question is updating. my new question is this;

  <?php

    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Headers: X-Requested-With');
    header('Access-Control-Allow-Headers: Content-Type');
    header('Access-Control-Allow-Methods: POST,GET,OPTIONS,DELETE,PUT');

    header('Cache-Control:public, max-age=100');

    if ($db = ibase_connect('111.222.333.444:C:\xx\xx\xx\xx\xx\xx.FDB', 'SYSDBA',
      'masterkey')) {



        $sql = "select * from STOK where barkodu='$barkodu'";

        $query =  ibase_prepare($sql);
        $rs=ibase_execute($query);


        if($row = ibase_fetch_row($rs)){

        $stok_adi = $row[2];

        $sonuc->stok_adi = $stok_adi;

      }

        ibase_close($db);

      } 
      else {
        $sonuc->durum = "cevapyok";
        }
      echo json_encode($sonuc);


    ibase_free_query($query);
    ibase_free_result($rs);
 ?>

There is my codes, its working normally with;

$sql = "select * from STOK";

But i want this;

$sql = "select * from STOK where barkodu='$barkodu'";

How can i get $barkodu with http post from external ? Thanks.

By the way; i have changed my ip adress with 111.222.333.444 and my database location with C:\xx\xx\xx\xx\xx\xx.FDB for my safety

Solution

Warning: I don't normally program in PHP, this answer is based on reading the documentation and my knowledge of Firebird.

Your current code is unsafe and vulnerable to SQL injection. Instead of using string interpolation to put your value directly into the query string, you should use a parameterized query instead.

That is, you need to change your code to:

$sql = "select * from STOK where barkodu=?";

$query = ibase_prepare($sql);
$rs = ibase_execute($query, $barkodu);

Or, given you're not reusing the query:

$sql = "select * from STOK where barkodu=?";
$rs = ibase_query($sql, $barkodu);