how to allow users to write queries without being executed - php

Question

well im making a blog that is almost done.. i wana allow users to post questions where they can post a query as there comment without allowing this query to be actually executed .. i tried making some security .. i used mysql_real_escape_string, htmlentities(), htmlspecialchars(), strip_tags() and addslashes()
.. however when i write something like
SELECT * FROM TABLE an error occurs disallowing me from posting the comment
im inserting the comments using this query
$sql = 'INSERT INTO comments (topic_id,commenters_id,comment,media,mediaType) VALUES ("' . $topic_id . '", "' . $commenter_id . '", "' . $comment . '", "' . $media . '", "' . $mediaType . '")';

Answer 1

You should be able to insert a comment containing SQL without it being executed. The reason you are having trouble is that you are concatenating user input into your SQL string. If you use prepared statements and bind the user input as parameters instead, you won't have this problem.Here is an example of how to do that (adapted from the PHP quickstart guide on mysqli prepared statements).
$sql = 'INSERT INTO comments
(topic_id,commenters_id,comment,media,mediaType) VALUES (?, ?, ?, ?, ?)';
// prepare
if (!($stmt = $mysqli->prepare($sql))) {
echo "Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error;
}
// bind parameters (I'm not sure if I picked the correct types here)
if (!$stmt->bind_param("iisss", $topic_id, $commenter_id, $comment, $media, $mediaType)) {
echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
}
// execute
if (!$stmt->execute()) {
echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
}