properly sanitize multiple user inputs with mysqli

bind, mysqli, php, security

Solution

You need to prepare the statement to be safe. Something like below (its probably not 100% but gives you an idea)

 $sql = new mysqli("localhost", "my_user", "my_password", "world");


    $stmt = $sql->prepare("INSERT INTO Persons (msg, ip, time, main, twit, city, lat, lon, lang)
        VALUES
        (?, ?, ?, ?, ?, ?, ?, ?, ?)");
        $stmt->bind_param("sssssssss",$_POST[msg], $ip, $date, $_POST[main], $_POST[twit],  $cit, $lat, $lon, $_POST[lang]);
    $stmt->execute();

Problem

Im currently using mysqli, and I want a way to properly sanitize every single user input. Im looking for the most simple lightweight way to do this, as I understand that Im NOT supposed to use mysql_real_escape.... my query is like so ``` $stmt = $sql->prepare("INSERT INTO Persons (msg, ip, time, main, twit, city, lat, lon, lang) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"); ``` as i understand i'm supposed to use the function bindParam... If i use it like so, am i completley securing my user inputs? ``` $stmt->bind_param('sssssssss', $_POST[msg], ('$ip'), ('$date'), '$_POST[main]', '$_POST[twit]', ('$cit'), ('$lat'), ('$lon'), '$_POST[lang]'); $stmt->execute(); $stmt->close(); ``` If this isn't securing my user inputs how do i properly do so?

Original source