[Sapper187]

Before I get too far into rewriting my code, I want to make sure I'm converting things from mysql to mysqli correctly.

// Old code
function protect($string) {
    return mysql_real_escape_string(strip_tags(addslashes($string)));
}

// New code, $db is in my connect function to connect to the database
function protect($string) {
    $string = $db->real_escape_string(strip_tags(addslashes($string));
}

// Or can I do this?
function protect($string) {
    return $db->real_escape_string(strip_tags(addslashes($string));
}

This function is used on both my register.php and login.php here:

// register.php
<?php
if(isset($_POST['register'])){
    $username = protect($_POST['username']);
    $password = protect($_POST['password']);
    $email = protect($_POST['email']);
    
// login.php
$username = protect($_POST['username']);
$password = protect($_POST['password']);        

Am I both using and calling that correctly?

[Dormilich]

Sapper187, on 09 February 2013 - 12:59 PM, said:

Am I both using and calling that correctly?

no.

unlike Java​Script, you cannot access variables from a parent scope inside functions. so you would have to pass the variables as well (also called Dependency Injection). and variables inside functions cannot be accessed outside of it (except for references variables, but that’s a whole different approch). Using global variables is out of question.

Sapper187, on 09 February 2013 - 12:59 PM, said:

// New code, $db is in my connect function to connect to the database
function protect($string) {
    return $db->real_escape_string(strip_tags(addslashes($string));
}

first, addslashes() is absolutely counter-productive (essentially you preserve inserted slashes in your data, which you would have to remove later). if any, it would be

function protect($string, $db) {
    return $db->real_escape_string(strip_tags(stripslashes($string));
}

on the other-hand-side, Prepared Ptatements make SQL Injection impossible (and the use of real_escape_string() obsolete). if you run your user data through validation/sanitisation by filter functions, strip_tags() (and related) is applied by default.

This post has been edited by Dormilich: 09 February 2013 - 05:23 AM