-2

I want to store some download counts with the name of the downloadfile in a database. This is working fine:

$filename = $_GET['file'];
// in combination with
mysqli_query($link, "INSERT INTO download_manager (filename,downloads) 
                         VALUES ('$filename',1) ON DUPLICATE KEY UPDATE downloads = downloads+ 1;");

Now i want to escape the $_GET with mysqli_real_escape_string

When i do it like this, the script is not working anymore:

$filename = mysqli_real_escape_string($_GET['file']);
// in combination with
mysqli_query($link, "INSERT INTO download_manager (filename,downloads) 
                         VALUES ('$filename',1) ON DUPLICATE KEY UPDATE downloads = downloads+ 1;");

How can i use the mysqli_real_escape_string in this example on the right way?

Dharman
  • 26,923
  • 21
  • 73
  • 125
nuet maessen
  • 131
  • 10

1 Answers1

0

from php document mysqli_real_escape_string Procedural style

string mysqli_real_escape_string ( mysqli $link , string $escapestr )

so your code should be

$filename = mysqli_real_escape_string($link,$_GET['file']);