How to check if a variable is a MYSQL query? It needs to exclude sql injection. I tried to write regular expressions, but it's veeeery hard. I think, that checking it would be easier.
If you want to prevent any SQL injection occurring your best option would be to use
Prepared Statements. This removes the need to check the content of the variable to detect with it contains any SQL.
$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)"); $stmt->bind_param("sss", $firstname, $lastname, $email); // set parameters and execute $firstname = "John"; $lastname = "Doe"; $email = "email@example.com"; $stmt->execute(); $firstname = "Mary"; $lastname = "Moe"; $email = "firstname.lastname@example.org"; $stmt->execute();
in the bind_param function, the first parameter sets the type of data.
s for string and
i for int. Then specify the variables you would like to add.
Then all you need to do is change the variables value and call the execute function.
See this link for more details: https://www.w3schools.com/php/php_mysql_prepared_statements.asp