I am very new to PHP coding, hence just wanted to know if my coding is prone to any SQL injection attack or any other kind of threat. Below is the code for adding client to the database:
<?php
$response = array();
include 'db/db_connect.php';
include 'functions.php';
//Get the input request parameters
$inputJSON = file_get_contents('php://input');
$input = json_decode($inputJSON, TRUE); //convert JSON into array
//Check for Mandatory parameters
if(isset($input['clientName']) && isset($input['siteName'])){
$clientName = $input['clientName'];
$siteName = $input['siteName'];
//Check if client already exist
if(!clientExists($clientName, $siteName)){
//Query to add new material
$insertQuery = "INSERT INTO clients(clientName, siteName) VALUES (?,?)";
if($stmt = $con->prepare($insertQuery)){
$stmt->bind_param("ss",$clientName,$siteName);
$stmt->execute();
$response["status"] = 0;
$response["message"] = "Client created";
$stmt->close();
}
}
else{
$response["status"] = 1;
$response["message"] = "Client exists";
}
}
else{
$response["status"] = 2;
$response["message"] = "Missing mandatory parameters";
}
echo json_encode($response);
?>
Code for clientExists() function is as follows:
function clientExists($clientName,$siteName){
$query = "SELECT clientName FROM clients WHERE clientName = ? AND siteName=?";
global $con;
if($stmt = $con->prepare($query)){
$stmt->bind_param("ss",$clientName,$siteName);
$stmt->execute();
$stmt->store_result();
$stmt->fetch();
if($stmt->num_rows == 1){
$stmt->close();
return true;
}
$stmt->close();
}
return false;
}
