Is this correct MYSQLI implementation? IS it safe from injection? IS the object cleanup done properly?
<?php
include_once '../../securelogin/db_connect.php';
include_once '../../securelogin/functions.php';
sec_session_start();
if (login_check($mysqli) == true)
{
$con = new mysqli("localhost", "username", "password", "databasename_todo");
// Check connection
if ($con->connect_errno)
{
echo "Failed to connect to MySQL: (" . $con->connect_errno . ") " . $con->connect_error;
}
else
{
$jsonText = file_get_contents('php://input');
$decodedText = html_entity_decode($jsonText);
$myArray = json_decode('[' . $decodedText . ']', true);
$newText = $myArray[0]['TEXT'];
$newOwnerID = $myArray[0]['OWNER_ID'];
$newCreateDate = date("Y-m-d");
$newCompleted = 'N';
$newText = mysqli_real_escape_string($con, $newText);
if(!($sql = $con->prepare("INSERT INTO checklistitems (TEXT, OWNER_ID, COMPLETED, CREATE_DATE, CREATE_USER) VALUES (?,?,?,?,?)")))
{ echo "Prepare failed: (" . $con->errno . ") " . $con->error;}
if(!$sql->bind_param('sissi', $newText, $newOwnerID, $newCompleted, $newCreateDate, $newOwnerID))
{echo "Binding parameters failed: (" . $sql->errno . ") " . $sql->error;}
if(!$sql->execute())
{echo "Execute failed: (" . $sql->errno . ") " . $sql->error;}
echo "SUCCESS - Affected rows ADD: " . $con->affected_rows;
$sql->close();
}
$con->close();
$con = null;
}
else
{
echo "Error! You are not authorized to access this page. Please login.";
}
?>