title: How can i prevent SQL injection when using MySQLi?
body: <p>How would i prevent SQL injections in a SQL query like this?</p>
  
  <pre><code>&lt;?php
  $mysqli = new mysqli("ip", "username", "pass", "database");
  
  /* check connection */
  if (mysqli_connect_errno()) {
      printf("Sorry, the login server is 'Under Maintainance'");
      exit();
  }
  
  $username = $_POST["username1"];
  $username = strtolower($username);
  $password = $_POST['password1'];
  $hash = sha1(strtolower($username) . $password);
  
  $query = "SELECT * FROM accounts WHERE name='$username'";
  
  if ($result = $mysqli-&gt;query($query)) {
      /* determine number of rows result set */
      $rownum = $result-&gt;num_rows;
  
  if($rownum != 0)
  {
  while ($row = $result-&gt;fetch_assoc()) {
    {
    $acct = $row['acct'];
    $pass = $row['pass'];
  }
  if($hash == $pass){
  session_start();
  $_SESSION['name']=$username;
  $_SESSION['acct']=$acct;
  header('Location:index.php');
  } else {
  echo 'There was an error when logging in. Make sure your password and username are correct.';
  }
  }
      $result-&gt;close();
  }
  else
  {
  echo 'Account does not exist. Please &lt;a href="register.php"&gt;Register&lt;/a&gt; an account before logging in.';
  }
      $mysqli-&gt;close();
  }
  ?&gt;
  </code></pre>
  
  <p>I have already added encryption but i cannot seem to find a prevention method that i know how to use yet. Also, is it possible for a user to use a MySQL injection without using an input box? (page dissection???)</p>