Safe code or not? (Help needed) [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 7 years ago.
Improve this question
Is this code safe to use for my website? Without sql injections or hacking, yes or no? I dont want to be hacked etc.
<?php
$db = new mysqli ("localhost", "-", "-", "-");
if($_GET['look'] && $_GET['username'])
{
$username = $db->real_escape_string($_GET['username']);
$look = $db->query("SELECT look FROM users WHERE username = '".$username."'")->fetch_assoc();
echo $look['look'];
}
if($_GET['missie'] && $_GET['username'])
{
$username = $db->real_escape_string($_GET['username']);
$motto = $db->query("SELECT motto FROM users WHERE username = '".$username."'")->fetch_assoc();
echo $motto['motto'];
}
if($_GET['while'] && $_GET['status'])
{
$status = $db->real_escape_string($_GET['status']);
$motto = $db->query("SELECT * FROM users WHERE motto = '".$status."'");
while($lol = $motto->fetch_assoc()) {
echo $lol['username'] . '/';
}
}
?>
And how can i improve it?

Answer 1

If you look at the function description for mysql_real_escape_string, it states
mysql_real_escape_string — Escapes special characters in a string for use in an SQL statement
so it will escape your parameters but I would not recommend relying wholly on that.
In future versions, php will no longer support mysql or mysqli and you will need to use PDO. A good resource that I have used a number of times for my own projects is http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers.
PDO allows you to create prepared statements and will escape your parameters for you and protect yourself from sql injection. Here is an example of how you could do that using PDO:
$db = new \PDO('mysql:host=localhost;dbname=test;charset=utf8', 'username', 'password');
$stmt = $db->prepare('
SELECT *
FROM `book` AS b
WHERE b.genre = ?
');
$stmt->execute(array('fantasy')); // Will replace the ? with 'fantasy' and escape it