syntax of sprintf

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View

until i started using the techniques for avoiding sql injection, i
have been using a normal insert and select sql query which worked

i have a registration page where a user enters their username and if
this already exists i display a message by executing a select query
and if the username does not exist then i run an insert query.

after adopting the technique to avoid sql injection

$username = stripslashes($_POST["username"]);
$email =    stripslashes($_POST["email"]);

$username = $_POST["username"];
$email =    $_POST["email"];
previously my select and insert query were

INSERT INTO individuals(username, email) values('$username', '$email')
Select username from individuals where username = '$username'

presently the insert query is

$insertquery = sprintf("INSERT INTO individuals (username, email)
VALUES ('%s', '%s')",

This insert query is working however the select query is not doing its
task as before of checking if the username already exists or not, even
if i register with the same username again it does not alert that the
username exists.

the select query is

$selectqueryusername = sprintf("Select username from individuals where
username='%s'", mysql_real_escape_string($username));

should i change the syntax of the above select query or is there
something else in need to do to fix the select query.

also for insert query if i have a numeric value i should be writting
%d correct, i have a numeric value however before inserting that
numeric value i am appending a character "-" to combine area code and
phone number example 09-123 4567 so i am considering this as %s as
there is a character. is this correct.

please advice.


Re: syntax of sprintf


Quoted text here. Click to load it

What does "not doing its task" mean? Do you get any error messages? Do
you have any error checking at all? Does MySQL complain about something?

Quoted text here. Click to load it

Looks OK.

The posted code is not enough to say where the problem might be.

Quoted text here. Click to load it

Correct, if it's an integer.

Quoted text here. Click to load it

Correct. This is not a number anymore, but a string.


Re: syntax of sprintf

Quoted text here. Click to load it

Agreed - the posted code should do what is intended - the bug lies


Site Timeline