PHP: SQL Injections

[vedran]

I'm getting following messages in my browser:

Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /home/omeragic/public_html/rebus/test/index.php on line 38

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/omeragic/public_html/rebus/test/index.php on line 40

What is causing them?

[John]

That error is due to an invalid query being supplied.

[Ricardo-san]

Thanks, excellent article. Learned quite a lot.

[John]

I am glad you liked it.

[kailas]

thanks for the clear tutorial

[fyhring4]

Instant of using the function array_map can't you use the foreach function?
Like this:

foreach($_GET as $key => $value){
    if(get_magic_quotes_gpc()){
    $_GET[$key] = stripslashes($value);
    $_GET[$key] = mysql_real_escape_string($value);
    }else{
    $_GET[$key] = stripslashes($value);
    $_GET[$key] = mysql_real_escape_string($value);
    }
} 

Or is it better without get_magic_quotes_gpc()?

foreach($_GET as $key => $value){
    $_GET[$key] = stripslashes($value);
    $_GET[$key] = mysql_real_escape_string($value);
} 

[Alexander]

@fyhring4: You can use foreach, but array_map relies on slightly more internal principles, atleast in development less code is often better, especially if it is more efficient. Your code makes not very much sense though, you may wish to wrap that reusable code in a function.