title: PHP / MySQLi: How to prevent SQL injection on INSERT (code partially working)
body: <p>I<strong>I would like to store two values (an email and a password) in a MySQL db using PHP</strong>. The input is passed to the PHP page via Ajax in jQuery (through an onclick event on a website).</p>
  <p>Now <strong>I want to protect this PHP query against SQL injection</strong> - I am talking about a standard website so I don't want to overdo it but I think some standard protection can't be bad.</p>
  <p>Below is what I had before just to ensure that the general procedure is working which it is.
  I then tried to increase security by using <strong>password encryption</strong> and <strong>statements</strong> but I am not sure if I did this the right way + I don't know if and how this needs to be applied to the Select part as well (where I am checking if the email already exists).</p>
  <p>I've seen plenty of pages on this topic but as a beginner that's exactly my problem here.
  Can someone tell with this as an example what should be changed or added here and maybe provide some short explanations ? I would like to keep using <strong>MySQLi</strong> if possible.</p>
  <p><strong>Old PHP:</strong></p>
  <pre><code>$conn = new mysqli($servername, $username, $password, $dbname);
  $conn-&gt;set_charset(&quot;utf8&quot;);
  if($conn-&gt;connect_error){
      die(&quot;Connection failed: &quot; . $conn-&gt;connect_error);
  }
  $email = $_POST[&quot;email&quot;];
  $pw = $_POST[&quot;pw&quot;]; 
  
  $sql = &quot;SELECT email FROM Users WHERE email = '&quot; . $email . &quot;'&quot;;
  $query = $conn-&gt;query($sql);
  if(mysqli_num_rows($query) &gt; 0){
      echo &quot;Record already exists&quot;;
  }else{
      $sql = &quot;INSERT INTO Users (email, pw) VALUES ('&quot; . $email . &quot;', '&quot; . $pw . &quot;')&quot;;
      if($conn-&gt;query($sql)){
          echo &quot;Update successful&quot;;
      }else{
          echo &quot;Update failed&quot;;
      };
  }
  $conn-&gt;close();
  </code></pre>
  <p><strong>New PHP:</strong></p>
  <pre><code>$conn = new mysqli($servername, $username, $password, $dbname);
  $conn-&gt;set_charset(&quot;utf8&quot;);
  if($conn-&gt;connect_error){
      die(&quot;Connection failed: &quot; . $conn-&gt;connect_error);
  }
  $email = $_POST[&quot;email&quot;];
  $pw = password_hash($_POST[&quot;pw&quot;], PASSWORD_BCRYPT); 
  
  $sql = &quot;SELECT email FROM Users WHERE email = '&quot; . $email . &quot;'&quot;;
  $query = $conn-&gt;query($sql);
  if(mysqli_num_rows($query) &gt; 0){
      echo &quot;Record already exists&quot;;
  }else{
      $sql = $conn-&gt;prepare(&quot;INSERT INTO Users (email, pw) VALUES ('&quot; . $email . &quot;', '&quot; . $pw . &quot;')&quot;);
      $sql-&gt;bind_param('s', $name);
      $sql-&gt;execute();
      $result = $sql-&gt;get_result();
      if($result){
          echo &quot;Update successful&quot;;
      }else{
          echo &quot;Update failed&quot;;
      };
  }
  $conn-&gt;close();
  </code></pre>