Return to Revisions

Do not use this code and php5, if you want to use mysqli + "procedural style", use mysqli_real_escape_string. The best way out - use "prepared statement"

My example (This is INPUT)

  function insert_users($users) {
    global $db;

    $hashed_password = password_hash($users['password'], PASSWORD_BCRYPT);

    $sql = "INSERT INTO users ";
    $sql .= "(first_name, last_name, email, username, hashed_password) ";
    $sql .= "VALUES (";
    $sql .= "'" . mysqli_real_escape_string($db, $users['first_name']) . "',";
    $sql .= "'" . mysqli_real_escape_string($db, $users['last_name']) . "',";
    $sql .= "'" . mysqli_real_escape_string($db, $users['email']) . "',";
    $sql .= "'" . mysqli_real_escape_string($db, $users['username']) . "',";
    $sql .= "'" . mysqli_real_escape_string($db, $hashed_password) . "'";
    $sql .= ")";
    $result = mysqli_query($db, $sql);

    // For INSERT statements, $result is true/false
    if($result) {
      return true;
    } else {
      // INSERT failed
      echo mysqli_error($db);
      exit;
    }
  }

How to use this function?

$result = insert_users($users);

Use strip_tags for OUTPUT