Edit Report a Bug

    mysqli::real_query

    mysqli_real_query

    (PHP 5, PHP 7, PHP 8)

    mysqli::real_query -- mysqli_real_query — Execute an SQL query

    Descrizione

    Stile orientato agli oggetti

    public mysqli::real_query(string $query): bool

    Stile procedurale

    mysqli_real_query(mysqli $mysql, string $query): bool

    Executes a single query against the database whose result can then be retrieved or stored using the mysqli_store_result() or mysqli_use_result() functions.

    Avviso

    Security warning: SQL injection

    If the query contains any variable input then parameterized prepared statements should be used instead. Alternatively, the data must be properly formatted and all strings must be escaped using the mysqli_real_escape_string() function.

    In order to determine if a given query should return a result set or not, see mysqli_field_count().

    Elenco dei parametri

    link

    Solo nello stile procedurale: un identificatore restituito da mysqli_connect() o mysqli_init()

    query

    The query string.

    Valori restituiti

    Restituisce true in caso di successo, false in caso di fallimento.

    Errori/Eccezioni

    If mysqli error reporting is enabled (MYSQLI_REPORT_ERROR) and the requested operation fails, a warning is generated. If, in addition, the mode is set to MYSQLI_REPORT_STRICT, a mysqli_sql_exception is thrown instead.

    Vedere anche:

    add a note add a note

    User Contributed Notes 3 notes

    up
    1
    TIL
    6 years ago
    Please note that this example is vulnerable to injection and uses plain-stored passwords...
    up
    0
    jay at cloudulus dot media
    5 years ago
    Well, we don't know if $password is in plain text because it was never defined in the example.

    New passwords should be stored using

    <?php
    $crypt_pass     = password_hash($password, PASSWORD_DEFAULT);
    ?>

    Where PASSWORD_DEFAULT = BCRYPT algorithm

    Then to compare a user entered password to a database stored password, we use:

    <?php
    $valid     = password_verify($password, $crypt_pass);
    ?>

    Which returns true or false.

    As for being vulnerable to injection, this is true. To avoid this, use sprintf() or vsprintf() to format the query and inject the values using mysqli::real_escape_string, like so:

    <?php
    $vals     = [$db->real_escape_string($username), $db->real_escape_string($password)];
    $query = vsprintf("Select * From users Where username='%s' And password='%s'", $vals);
    $result = $db->real_query($query);
    ?>
    up
    -58
    Tinker
    8 years ago
    Straightforward function - simply connect to the database and execute a query, similar to this function bellow.

    <?php

    function check_password($username, $password) {
    // Create connection
    $db = new mysqli('localhost','database_user','database_pass','database_name');

    // Check for errors
    if($db->connect_errno){
    echo     $db->connect_error;
    }

    // Execute query
    $result = $db->real_query("Select * From users Where username='$username' And password='$password'");

    // Always check for errors
    if($db->connect_errno){
    echo     $db->connect_error;
    }

    return     $result == true;
    }
    ?>

    Very easy.

    Replace database_user, database_pass and database_name with the proper names, and the text inside real_query with your actual query.

    Don't forget the quotes on either side (except for numbers, there you can omit them) otherwise it won't work. Hope that helps someone.
    add a note add a note
    To Top