1
\$\begingroup\$

I have this code I use to connect to the database and get a thing from it secure, How can I make more secure??

class db {
    // The database connection
    protected static $connection;

    /**
     * Connect to the database
     * 
     * @return bool false on failure / mysqli MySQLi object instance on success
     */
    protected function connect() {    
        // Try and connect to the database
        if(!isset(self::$connection)) {

            // Load configuration there are defined in config.php
            require_once('app/config/config.php');
            self::$connection = new mysqli(DB_HOST, DB_USERNAME, DB_PASSWORD, DB_DBNAME);
        }

        // If connection was not successful, handle the error
        if(self::$connection === false) {
            // Handle error - notify administrator, log to a file, show an error screen, etc.
            return false;
        }
        return self::$connection;
    }



    /*
        Query the database

        @param $query The query string
        @return mixed The result of the mysqli::query() function
    */
    private function query($query) {
        // Connect to the database
        $connection = $this->connect();

        // Query the database
        $result = $connection->query($query);
        return $result;
    }

    /*
        Fetch rows from the database (SELECT query)

        @param $query The query string
        @return bool False on failure / array Database rows on success
    */
    public function select($query) {
        $result = $this->query($query);

        if($result === false) {
            return false;
        }

        $rows = array();
        while ($row = $result->fetch_assoc()) {
            $rows[] = $row;
        }
        return $rows; 
    }
}


When I want infomation from the DB Example:

$db = new db();
$result = $db->select("SELECT * FROM users WHERE name = John");
\$\endgroup\$
  • \$\begingroup\$ PS: I'm new on codereview so if the post is wrong placed I delete it :) \$\endgroup\$ – TheCrazyProfessor Dec 21 '16 at 11:46
  • \$\begingroup\$ @BCdotWEB better now? :) \$\endgroup\$ – TheCrazyProfessor Dec 21 '16 at 12:28
4
\$\begingroup\$

You're asking the wrong question. The right question is "What should I use instead of query?" The answer is that if you want to reinvent the wheel, you should use prepared statements, and if you don't then you should use an ORM which uses prepared statements under the hood. Prepared statements allow you to pass in parameters and ensure that the escaping is done correctly. E.g. you would use "SELECT * FROM foo WHERE bar = ?" passing parameter "baz" rather than "SELECT * FROM foo WHERE bar = " . mysqli_real_escape_string("baz").

\$\endgroup\$
  • \$\begingroup\$ what do the prepared? \$\endgroup\$ – TheCrazyProfessor Dec 21 '16 at 11:57
  • \$\begingroup\$ Peter is correct... using prepared statements avoids security holes in SQL statements. Imagine someone putting in Fred'; TRUNCATE TABLE users;. Suddenly all user records are gone. :( \$\endgroup\$ – Phil M Dec 21 '16 at 23:02
  • \$\begingroup\$ well I have look at it, and thanks you get a like from me :) \$\endgroup\$ – TheCrazyProfessor Dec 25 '16 at 10:38
  • \$\begingroup\$ Hi again, and thanks for the answer, its work. I try to hack it in both normal mysqli connection and prepare and I get the same results and that's why I ask you. How is that's possible?? \$\endgroup\$ – TheCrazyProfessor Dec 29 '16 at 18:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.