How can I prevent SQL injection in PHP? If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')"); That's because the user can input something like value'); DROP TABLE table;--, and the query becomes: INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--') What can be done to prevent this from happening? Answer: Use prepared statements and parameterized queries. These are SQL statements that

MySQL/Apache Error in PHP MySQL query I am getting the following error: Access denied for user 'apache'@'localhost' (using password: NO) When using the following code: <?php include("../includes/connect.php"); $query = "SELECT * from story"; $result = mysql_query($query) or die(mysql_error()); echo "<h1>Delete Story</h1>"; if (mysql_num_rows($result) > 0) { while($row = mysql_fetch_row($result)){ echo '<b>'.$row[1].'</b><span align="right"><a href="../process/delete_story.php?id='.$row[0].'">Delete</a></span>'; echo '<br /><i>'.$row[2].'</i>'; } } else { echo "No stories available."; } ?> The connect.php file contains my MySQL connect calls that are working fine with my INSERT queries in

Select and Update in same time and gets displayed I have this query: SELECT MIN(id),CustomerName, Scenario,StepNo,InTransit,IsAlef,runNo,ResponseLength FROM `RequestInfo` WHERE `CustomerName` = 'Hotstar' AND `ResponseContentType` like '%video/MP2T%' AND `RequestHttpRequest` like '%segment%' ; which gives me output like this:- +---------+--------------+----------+--------+-----------+--------+-------+----------------+----------+ | MIN(id) | CustomerName | Scenario | StepNo | InTransit | IsAlef | runNo | ResponseLength | IsActive | +---------+--------------+----------+--------+-----------+--------+-------+----------------+----------+ | 139 | HotStar | SearchTv | 1 | No | No | 1 | 410098 | NULL | +---------+--------------+----------+--------+-----------+--------+-------+----------------+----------+ I want to insert string