Php-mysql injection

Question

<?php
error_reporting(E_ALL);
//ini_set('display_errors', 1);

$db_server = "localhost";
$db_name = "2";
$db_user = "root";
$db_passwd = "";

$connection = mysql_connect($db_server,$db_user,$db_passwd);
$db = mysql_select_db($db_name,$connection) or die("Couldn't Select Database");

if($_POST['text']){
    $result=mysql_query("SELECT * FROM login WHERE id='".  mysql_real_escape_string($_POST['text'])."'");
    while($row=mysql_fetch_array($result)){
        echo "<span>".$row['id']."</span>";
    }
}
?>
<form name="form" method="post" action="">
    <input type="text" id="text" name="text"/>
    <input type="submit" value="Submit"/>
</form>

Anyway to inject the mysql on this kind of structure? The database on with 1 Table 1 column with name id, just simple store "abc,bca,cab". Thanks.

Answer 1

Short answer, no.

But mysql_real_escape_string isn't the only thing that protects you here.

See :

$text = mysql_real_escape_string($_POST['text']); // $_POST['text'] == "1 OR 1=1"
$result = mysql_query("SELECT * FROM login WHERE id = $text");

You're not protected here, and an injection was made. So your quotes are protecting you against this here. You could also type cast (int) instead since it's an id.

As a side note, you shouldn't use mysql, but mysqli instead.

With mysqli you can use prepared statements that'll protect you against any of this, as it will perform the query with the dynamic part treated as a string at all time.