I have a question with mysqli_query() , How do I send variables to my query ?
I have the following code But it marks me an error when executing it How can I send the parameters POST to my query ?
<?php
require ('conexionbd.php');
$varusr = $_POST['usr'];
$varpwd = $_POST['pwd'];
$query = "CALL validaingreso('$varusr','$varpwd')"
$result = mysqli_query($enlace,$query);
echo $row_cnt = mysqli_num_rows($result);
?>
You must concatenate your variables with points, I show you what your query should look like:
$query = "CALL validaingreso('" . $varusr . "','" . $varpwd . "')";
$result = mysqli_query($enlace,$query);
Note how the quotes are closed every time you concatenate a variable, with this you indicate to PHP that it is text and that it is code, and with the point you indicate concatenation of texts so PHP translates it as "to this text add the value of this variable "
The way to solve your problem definitively would be to implement queries prepared , since sending this query $query = ("CALL validaingreso('$varusr','$varpwd')"); to run directly is a serious security hole.
Let's see how to implement prepared queries in this case, explaining two possible ways to do it: using the procedural style (the one you implement in your code) and the object-oriented style (which is more modern and more understandable). Anyway, both work the same.
$varusr = $_POST['usr'];
$varpwd = $_POST['pwd'];
$query = ("CALL validaingreso(?,?)");
$stmt = mysqli_prepare($enlace, $query);
mysqli_stmt_bind_param($stmt, 'ss', $varusr, $varpwd);
mysqli_stmt_execute($stmt);
mysqli_stmt_store_result($stmt);
echo $row_cnt = mysqli_num_rows($stmt);
mysqli_stmt_close($stmt);
$varusr = $_POST['usr'];
$varpwd = $_POST['pwd'];
$query = ("CALL validaingreso(?,?)");
$stmt = $enlace->prepare($query);
$stmt->bind_param('ss', $varusr, $varpwd);
$stmt->execute();
$stmt->store_result();
echo $row_cnt = $stmt->num_rows();
$stmt->close();
? . This is the first step to neutralize the attack prepare to tell the handler to prepare that query for us. bind_param . This is the second step to neutralize the injection. The ss in the code means that the two columns used in this case are of type VARCHAR in the database. If for example any of them were of type INT we would have to put a i instead of the s . It is also important to point out that in bind_param the variables must be put in the order that corresponds to them in $query . And the same applies to the type of data. execute to finish the job. store_result . $stmt .