[PHP/MYSQL] Search injection prevention?

[tjmoore1993]

<?php
	if (isset($_GET['search'])) {		
		echo'<div class="post">
			<h2 class="title">Search</h2>
			<div class="entry">
				<p>
				<table width="100%" border="0">
        		<tr><td align="left"><strong>Course Name</strong></td><td align="center" width="100px"><strong>Course Code</strong></td><td width="100px"><strong>Course Grade</strong></td><td width="90px"><strong>Course Level</strong></td></tr>';
				$SEARCH = mysql_real_escape_string($_GET['search']);
				$RESULT = mysql_query("SELECT * FROM courses WHERE course_name='$SEARCH' ORDER BY course_grade");
				
				if (mysql_num_rows($RESULT) == 0) {
					header("location: academics.php");
				}
				while($ROW = mysql_fetch_array($RESULT)) {
		  			echo '<tr><td align="left"><a class="course_2" href=?view='. $ROW['id'].'>'. $ROW['course_name'] .'</a></td><td align="center">
					<strong>'. $ROW['course_code'] .'</strong></td><td>Grade '. $ROW['course_grade'] .'</td><td> '. $ROW['course_level'] .'</td></tr>';
          		}
				echo '</table></p></div></div>';
	} else if (isset($_GET['view'])) {
		$VIEW 	= stripslashes(mysql_real_escape_string($_GET['view']));
		$RESULT = mysql_query("SELECT * FROM courses WHERE id='$VIEW'");
		if (mysql_num_rows($RESULT) == 0) {
			header("location: academics.php");
		}
		$ROW 	= mysql_fetch_array($RESULT);
		echo'<div class="post"><h2 class="title">'. $ROW['course_name'] .'</h2><div class="entry"><p>
				<table width="100%" border="0">
					<tr><td width="80px"><strong>Course Name</strong></td><td width="3px">:</td><td>'. $ROW['course_name'] .'</td></tr>
					<tr><td><strong>Course Grade</strong></td><td>:</td><td>'. $ROW['course_grade'] .'</td></tr>
					<tr><td><strong>Course Level</strong></td><td>:</td><td>'. $ROW['course_level'] .'</td></tr>
					<tr><td><strong>Course Code</strong></td><td>:</td><td>'. $ROW['course_code'] .'</td></tr>
				</table>
				<br />
				<table width="100%" border="0">';
					for ($K=1; $K<=4; $K++) {
						$RESULT = mysql_query("SELECT * FROM teachers WHERE period".$K."='$VIEW'");
						$L = 0;
						while ($ROW = mysql_fetch_array($RESULT)) { 
							$TEACHER_PERIOD[$K]['name'][$L] = $ROW['name'];
							$TEACHER_LINK[$K]['link'][$L]	= $ROW['link']; 
							$L++;
						}
					}
					for ($I=1; $I<=4; $I++) {
						echo '<tr><td width="80px"><font color="#FF000"><strong>Period '. $I .'</strong>:</font></td></tr><tr><td>';
						$COUNT = count($TEACHER_PERIOD[$I]['name']);
						if ($COUNT == 0) {
							echo '<p class="course_1">NONE</p>';
						}
						for ($J=0; $J<=$COUNT-1; $J++) {
							echo '<a class="course_2" target="_blank" href="'. $TEACHER_LINK[$I]['link'][$J] .'">'.$TEACHER_PERIOD[$I]['name'][$J].'</a>';
							if ($COUNT - $J -1>= 1) {
								echo '<br />';
							}
						}
					}
					echo '</td></tr></table></p></div></div>';
	} else {
?>

<div class="post">
	<h2 class="title">Departments</h2>
	<div class="entry">
		<p> test! </p>
	</div>
</div>
<div class="post">
	<h2 class="title">Courses</h2>
	<div class="entry">
		<p>
			<?php
				echo '<table border="0" width="100%"><tr>';
				$I = 0;
				$RESULT = mysql_query('SELECT DISTINCT course_name FROM courses ORDER BY course_name ASC');
				while($ROW = mysql_fetch_array($RESULT)) {
 				   $I++;
    				echo '<td align="left" width="335px"><strong><a class="course_2" href="academics.php?search='.$ROW["course_name"].'">'.$ROW["course_name"].'</a></strong></td>';
   		 			if ($I == 2) {
						$I = 0;
         				echo '</tr><tr>';
    				}
				}
				echo "</tr></table>";
			?>
		</p>
	</div>
</div>
<?php } ?>

The code lists a bunch of courses by name and makes sure that each name is unique to prevent duplicates loading onto page.

From there, each name represents a search query, which is retrieved from a GET. However, I am not convinced that I am properly preventing SQL injection. A few queries have characters like ' & /. I avoid the stripslashes command, to allow a few queries to pass.
Ex. (Writer's Craft)

Any suggestions that can help? I would really like to insure nothing would be injected.

 

[darka5]

Start use and htmlspecialchars() it's remove HTML symbol from text.
Example you use: <b> aaa</b> ant this "<,'/." symbol will be erased.

One more function is preg_replace. If in your query shuld be only "[a-zA-z0-9) you can use this function.
If someone try to use: hack'/] this function remove all this ']/ and leave only text.

So you can choose what you use..

I propose use first function htmlspecialchars() and mysql_real_escape_string().

 

[Aaron]

You're fine, as long as you're sanitizing the $_GET[''] variables, or any variables that go into the database for that matter.

 

[jMerliN]

SPs or prepared statements are preferred.

 

[s-p-n]

Yeah, Prepared Statements make life easier once you get in the habit of using them.

The MySQLi extension make it pretty simple.. - different, but simple.

http://forum.ragezone.com/f578/php-mysql-mysqli-extension-rid-656725/

http://www.php.net/manual/en/intro.mysqli.php