I need help in converting this codes

if(!get_magic_quotes_gpc())
{
$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string',
$_POST);
$_COOKIE = array_map('mysql_real_escape_string',
$_COOKIE);
}
else
{ $_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);
$_COOKIE = array_map('stripslashes', $_COOKIE);
$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string',
$_POST);
$_COOKIE = array_map('mysql_real_escape_string',
$_COOKIE);
}

tried this but its not working



if(!get_magic_quotes_gpc())
{
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}
else
{
$_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);
$_COOKIE = array_map('stripslashes', $_COOKIE);
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}

Kingvick:
if(!get_magic_quotes_gpc())
{
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}
else
{
$_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);
$_COOKIE = array_map('stripslashes', $_COOKIE);
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}

Can you give more details?

MrWondah:
Can you give more details?

Pls check the topic again I modified it

Kingvick:
I need help in converting this codes



tried this but its not working

Your code looks good. But it might be a problem with your DB connection. Did you use mysqli or mysql in your db connection? if there is discrepancy your code wont work. So it would be better if you share the error code you got and the db connection code

MrWondah:

Your code looks good. But it might be a problem with your DB connection. Did you use mysqli or mysql in your db connection? if there is discrepancy your code wont work. So it would be better if you share the error code you got and the db connection code

i made use of mysqli here is the complete convertion i tried

<?php

$dbname = ""; // Your Sql Database Name

$dbuser = ""; // Your sql database username

$dbhost = ""; // its always localhost, except if your host states otherwise

$dbpass = ""; // Your sql database password


$db = mysqli_connect("$dbhost", "$dbuser", "$dbpass" or die("Could not connect.";
if(!$db)
die("no db";
if(!mysqli_select_db($db,"$dbname")
die("No database selected.";
if(!get_magic_quotes_gpc())
{
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}
else
{
$_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);
$_COOKIE = array_map('stripslashes', $_COOKIE);
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}
?>

Am geting this errors

[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 19
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 19
[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 20
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 20
[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 21
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 21

Kingvick:


Am geting this errors

[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 19
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 19
[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 20
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 20
[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 21
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 21

I'll take more look at your code, but from what I understand so far,

mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 19

you can only pass a string and not an array in that function. Another option is for you to iterate through an array and apply it to the values (and keys since you're handling post and get).

Kingvick:
I need help in converting this codes

if(!get_magic_quotes_gpc())
{
$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string',
$_POST);
$_COOKIE = array_map('mysql_real_escape_string',
$_COOKIE);
}
else
{ $_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);
$_COOKIE = array_map('stripslashes', $_COOKIE);
$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string',
$_POST);
$_COOKIE = array_map('mysql_real_escape_string',
$_COOKIE);
}

are you updating to php7.* ? if so get_magic_quotes_gpc() is depreciated as of php5.2 so it will throw an error on higher php versions

make use of this for your connection
<?php
$dbname = " "; // Your Sql Database Name
$dbuser = " "; // Your sql database username

$dbhost = " "; // its always localhost, except if your host states otherwise

$dbpass = " "; // Your sql database password


$db=($db = mysqli_connect("$dbhost", "$dbuser", "$dbpass", "$dbname", "3306") or die ('Cannot connect to the database because: ' . ((is_object($db)) ? mysqli_error($db) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)));
?>

then the best way to sanitize user input is using prepared statement (PDO) instead of mysqli_real_escape. Read about prepared statement pdo

Codedboy95:


are you updating to php7.* ? if so get_magic_quotes_gpc() is depreciated as of php5.2 so it will throw an error on higher php versions

make use of this for your connection
<?php
$dbname = " "; // Your Sql Database Name
$dbuser = " "; // Your sql database username

$dbhost = " "; // its always localhost, except if your host states otherwise

$dbpass = " "; // Your sql database password


$db=($db = mysqli_connect("$dbhost", "$dbuser", "$dbpass", "$dbname", "3306") or die ('Cannot connect to the database because: ' . ((is_object($db)) ? mysqli_error($db) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)));
?>

then the best way to sanitize user input is using prepared statement (PDO) instead of mysqli_real_escape. Read about prepared statement pdo

Yes am updating to php7. Thanks for this information

Kingvick:
Yes am updating to php7. Thanks for this information

As codeBoy advice please use PDO. This will help you with prepared statements to avoid SQL injection.


In Php7+ magic_quotes_gpc() is depreciated.


Now to your question, the issue was with your datatype. Mysqli_realescape_strug accepts

a. A mysqli Link
b. A string variable data type to be escaped.

Now in your code you passed the GET and POST variable global. So if you really want to escape all the variables in that array. Kindly use a for loop statement..




$iLen = count ($_GET)
cleanedUpGet=array();

foreach( $_GET as $key => $value ) {

cleanedUpGet[$key] = mysqli_realescape_string($dbConnection, $value)

}


var_dump($_GET)



______________________________

If you want to do it the Object Oriented Way do.


mysqli::escapestring($stringVariable)




_________________________

However I will advice you use PDO.


Note: I don't test the above code but I believe it would work.



@commenters: On a side note I no longer work on Php7, I left php a long time to rustLang, I wanted asking if Php community has embraced the static type introduction ??

Kingvick:

i made use of mysqli here is the complete convertion i tried

<?php

$dbname = ""; // Your Sql Database Name

$dbuser = ""; // Your sql database username

$dbhost = ""; // its always localhost, except if your host states otherwise

$dbpass = ""; // Your sql database password


$db = mysqli_connect("$dbhost", "$dbuser", "$dbpass" or die("Could not connect.";
if(!$db)
die("no db";
if(!mysqli_select_db($db,"$dbname")
die("No database selected.";
if(!get_magic_quotes_gpc())
{
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}
else
{
$_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);
$_COOKIE = array_map('stripslashes', $_COOKIE);
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}
?>

Am geting this errors

[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 19
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 19
[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 20
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 20
[14-Nov-2018 03:13:03 UTC] PHP Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /home/yukhubco/public_html/incfiles/connect.php on line 21
[14-Nov-2018 03:13:03 UTC] PHP Warning: array_map() expects at least 2 parameters, 1 given in /home/yukhubco/public_html/incfiles/connect.php on line 21

I dont know how procedural works in php because i work with OOP.
But i think i can try.

$server ="localhost";
$user="root";
$pass=""; if you are using default configuration
$db="db_you_are_conmecting_to";

//Procedural connection to db
$conn =mysqli_connect($server, $user, $pass, $db);

If($conn==mysqli_connect_error){
die("connection failed connecting to Db";
}

//Object Oriented
$conn = new mysqli($server, $user, $pass, $db);

If($conn->connect_error){
die("Error connecting to db";
}



About the mysqli_real_escape_string ..Two parameter must be pass to it.
E.g

$name=$_GET['name'] = "Charles";

To now escape the string b4 saving to db

$name = mysqli_real_escape_string($conn, $name);

Bro always sanitize your input before using mysqli escape string function to store the data to DB.

try harder

Kingvick:
I need help in converting this codes

if(!get_magic_quotes_gpc())
{
$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string',
$_POST);
$_COOKIE = array_map('mysql_real_escape_string',
$_COOKIE);
}
else
{ $_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);
$_COOKIE = array_map('stripslashes', $_COOKIE);
$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string',
$_POST);
$_COOKIE = array_map('mysql_real_escape_string',
$_COOKIE);
}

tried this but its not working



if(!get_magic_quotes_gpc())
{
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}
else
{
$_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);
$_COOKIE = array_map('stripslashes', $_COOKIE);
$_GET = array_map(mysqli_real_escape_string($db, $_GET));
$_POST = array_map(mysqli_real_escape_string($db, $_POST));
$_COOKIE = array_map(mysqli_real_escape_string($db, $_COOKIE));
}

Sometimes to change from mysqli to MySQL just require you removing the 'I'

Zsatan:


As codeBoy advice please use PDO. This will help you with prepared statements to avoid SQL injection.


In Php7+ magic_quotes_gpc() is depreciated.


Now to your question, the issue was with your datatype. Mysqli_realescape_strug accepts

a. A mysqli Link
b. A string variable data type to be escaped.

Now in your code you passed the GET and POST variable global. So if you really want to escape all the variables in that array. Kindly use a for loop statement..




$iLen = count ($_GET)
cleanedUpGet=array();

foreach( $_GET as $key => $value ) {

cleanedUpGet[$key] = mysqli_realescape_string($dbConnection, $value)

}


var_dump($_GET)



______________________________

If you want to do it the Object Oriented Way do.


mysqli::escapestring($stringVariable)




_________________________

However I will advice you use PDO.


Note: I don't test the above code but I believe it would work.



@commenters: On a side note I no longer work on Php7, I left php a long time to rustLang, I wanted asking if Php community has embraced the static type introduction ??

Thanks would test the codes