Question about sanitize and sql injection in php [duplicate] - php

Question

This question already has answers here:
How can I prevent SQL injection in PHP?
(27 answers)
Closed 2 years ago.
I am trying to build an application that detect if user's input(first 20 byte) exist on my database.
But I am stuck at sanitizing and making placeholder to it. Especially, this part $stmt->execute(), any advise and recommendation will be appreciated!
<?php
echo <<<_END
<form method='post' action='test.php' enctype='multipart/form-data' >
Tester: <input type='file' name='uploadfile'>
<input type='submit'>
</form>
_END;
if($_FILES){
require_once 'login.php';
if (!$conn) {
die(mysql_fatal_error());
}
$type = $_FILES['uploadfile']['type'];
if($type == "text/plain"){
$name = $_FILES['uploadfile']['name'];
$fh = fopen($name, 'r') or die("File Does not exist");
$content = file_get_contents($name, FALSE, NULL, 0, 20);
$content = sanitizeMySQL($conn, $content);
fclose($fh);
$stmt = $conn->prepare("SELECT * FROM storage WHERE mydata like ?");
$stmt->bind_param("s", $content);
$stmt->execute();
//$stmt->bind_result($content);
if (!$stmt) {
echo "Not Exist";
} else {
echo "Exist";
}
} else {
echo "txt only <br>";
}
}

Answer 1

This section of your code is already sanitising your input.
$stmt = $conn->prepare("SELECT * FROM storage WHERE mydata like ?");
$stmt->bind_param("s", $content);
$stmt->execute();
The first line lays out your sql query with parameters.
$stmt = $conn->prepare("SELECT * FROM storage WHERE mydata like ?");
The second line escapes any dangerous characters in the user input (i.e. in $content), and binds it to the position of the ? in your query in the line above.
$stmt->bind_param("s", $content);
The third line runs the query you created with the parameters you bound.
$stmt->execute();
An insecure method of doing this would look like this:
$stmt = $conn->prepare("SELECT * FROM storage WHERE mydata like '$content'");
If a user were to submit content which looked like this '; drop * from storage;//, then the resulting query would be:
SELECT * FROM storage WHERE mydata like ''; drop * from storage;//'
This would end up deleting all the data in your mydata table in your database.