title: SQL Injection - what else?
body: <p>I have the following PHP code on an intranet site, and I've recently learned about a Firefox addon <em>'SQL Inject Me'</em>. Out of curiousity I've tried to run it on this really simple site (basically a phonebook with an admin account). </p>
  
  <p>The test returned 51 #302 errors, but when I tried them I could not do any harm nor access (to) the database.</p>
  
  <p>Is there any more to do than this to prevent the injection? When I've searched, they all advised PDO prepared statements, but this was done using that.</p>
  
  <p><strong>PHP</strong></p>
  
  <pre><code>include_once("inetcon.php");
  session_start();
  $uid = $_POST['uid'];
  $pass = $_POST['pass'];
  
  // This is what I've added after seeing the errors
  
  $uid = mysql_real_escape_string($uid);
  $pass = mysql_real_escape_string($pass);
  
  $uid = str_replace("'","fag",$uid); 
  
  // end of block
  
  $extract = $handler-&gt;prepare('SELECT * FROM net_users WHERE users_fname = ? and users_role = ? and users_active = "2"');
  $extract-&gt;execute(array($uid, md5($pass)));
  </code></pre>
  
  <p>The addon returns all the basic ones like:</p>
  
  <pre><code>Server Status Code: 302 Found
  Tested value: 1' OR '1'='1
  </code></pre>
  
  <p>Thanks for the help.</p>