Search code examples
phpsql-injectionmysql-real-escape-string

I need to secure this PHP code from SQL injection attacks

Possible Duplicate:
Best way to stop SQL Injection in PHP

I need to secure this code from SQL injection attacks, possibly using mysql_real_escape_string. Where and how do I apply it? 

<?php
mysql_select_db("database");

$sql="INSERT INTO email (address) VALUES ('$_POST[address]')";

if (!mysql_query($sql))
  {
  die('Error: ' . mysql_error());
  }
echo "<center>THANK YOU!</center>";

?>
Solution

  • You should be able to just wrap your post value in mysql_real_escape_string():

    $address = mysql_real_escape_string($_POST[address]);

$sql="INSERT INTO email (address) VALUES ('$address')";