is this code safe from sql injections?

[harmor19]

I am new to coding vbulletin so I don't know the functions as such.

PHP Code:

$vbulletin->input->clean_array_gpc('p', array(
    'name' => TYPE_STR
    'email' => TYPE_STR,
    'text' => TYPE_NOHTML,
    'testid' => TYPE_INT
     ));

     $db->query_write("
    UPDATE " . TABLE_PREFIX . "testimonials SET
    name = '" . $db->escape_string($vbulletin->GPC['name']) . "',
    email = '" . $db->escape_string($vbulletin->GPC['email']) . "',
    text = '" . $db->escape_string($vbulletin->GPC['text']) . "',
    WHERE testid = " . $vbulletin->GPC['testid'] . "
    "); 


[Andreas]

Yes it is safe from SQL injections.
However, you will get a compile error as there is a missing comma after the first TYPE_STR.
Furthermore, if you store data this way, you must make sure to run it through the parser or htmlspecialchars_uni() before displaying it - otherwise you open Cross Site Scripting (XSS) leaks.
If you don't need raw data in the table, you can store HTML safe strings by using data verification type TYPE_NOHTML instead.

[harmor19]

I am getting a sql error

Here's the php

PHP Code:

$vbulletin->input->clean_array_gpc('p', array(
    'name' => TYPE_STR,
    'email' => TYPE_STR,
    'text' => TYPE_STR,
    'testid' => TYPE_INT
     ));

     $db->query_write("
    UPDATE " . TABLE_PREFIX . "testimonials SET
    name = '" . $db->escape_string($vbulletin->GPC['name']) . "',
    email = '" . $db->escape_string($vbulletin->GPC['email']) . "',
    text = '" . $db->escape_string($vbulletin->GPC['text']) . "',
    WHERE testid = " . $vbulletin->GPC['testid'] . "
    "); 


Here's the sql error

UPDATE testimonials SET
    name = 'erg4ewg',
    email = 'ewgwgew',
    text = 'gewgewrg <b>egeg</b>',
    WHERE testid = 1;

MySQL Error  : You have an error in your SQL syntax.  Check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE testid = 1' at line 5
Error Number : 1064

[Andreas]

The last comma (before WHERE) is wrong.

[harmor19]

Wow I can't believe I missed that.

I think I'm done with the editing, do I give it to you to review or just re-upload the zip and send out an update?

[Alan @ CIT]

Just re-upload the zip and send out an update.

[harmor19]

Thank you.

Please check it out https://vborg.vbsupport.ru/showthread.php?t=98906