Is this small bit of code correct...

[jack_23]

Is this small bit of code correct. I'm trying to add mysql_real_escape_string to all my queries. Is what i have below enough to stop SQL injections and other threats. Have i used it correctly

$username = mysql_real_escape_string($_POST['username']);
$check = mysql_query("SELECT username FROM accounts WHERE username = '$username'")
or die(mysql_error());
$check2 = mysql_num_rows($check); 

Also, can you take a small look at the code i have below

//retrieve form data in a variable
$firstname  = mysql_real_escape_string($_POST['firstname']);
$lastname      = mysql_real_escape_string($_POST['lastname']);
$username     = mysql_real_escape_string($_POST['username']);
$password      = mysql_real_escape_string($_POST['password']);

////// How to i add mysql_real_escape_string to the code below//////
$DOB         = date("Y-m-d", mktime(0,0,0,$_POST['DOBmm'],$_POST['DOBdd'],$_POST['DOByyyy'])); // keep the DOB as one 

Also, do i need to add stripslashes anywhere in my code, sorry i am new to the security of PHP

[MrCoder]

Check the post I made here

You should use typecasting on the values you are passing to mktime();

[NightShift58]

Use a function to check things out and take necessary action depending on the state of your server version and settings.

<?php
function sqlPrep($pSTR="") {
  $retSTR = get_magic_quotes_gpc() ? stripslashes(trim($pSTR)) : trim($pSTR);
  IF (function_exists("mysql_real_escape_string") AND mysql_ping()) :
    $retSTR = mysql_real_escape_string($pSTR);
  ELSEIF (function_exists("mysql_escape_string")) :
    $retSTR = mysql_escape_string($pSTR);
  ELSE :
    $retSTR = addslashes($pSTR);
  ENDIF;
  return $retSTR;
}
?>

[MrCoder]

Use a function to check things out and take necessary action depending on the state of your server version and settings.

<?php
function sqlPrep($pSTR="") {
  $retSTR = get_magic_quotes_gpc() ? stripslashes(trim($pSTR)) : trim($pSTR);
  IF (function_exists("mysql_real_escape_string") AND mysql_ping()) :
    $retSTR = mysql_real_escape_string($pSTR);
  ELSEIF (function_exists("mysql_escape_string")) :
    $retSTR = mysql_escape_string($pSTR);
  ELSE :
    $retSTR = addslashes($pSTR);
  ENDIF;
  return $retSTR;
}
?>

He is back!! \o/

Where you been buddy?

[NightShift58]

Was out of the loop, doing real work, sort of...

[MrCoder]

Good to know your ok mate.

[NightShift58]

Rainy season is beginning to show its ugly face - otherwise everything good on this side of the world.

[bokeh]

everything good on this side of the world.

Which side?

[MrCoder]

The dark side

[NightShift58]

Which side?

the dark side

My side, the dark side...

But I should be in Mallorca again in the next 15 days. Finally sold that darned restaurant...

[MrCoder]

You owned a restaurant?

[NightShift58]

In the bad old days, four of them... Just down to one, which will hopefully be a goner soon. After that, no more, never again.

[MrCoder]

Stress?

[NightShift58]

The first one opened at 07:30 a.m. and the last one closed at 03:30 a.m.
Wife, kids, 2 other companies.

Stress? What's that?

[MrCoder]

And you still found time to post on here :O