Re: php mysql comparing two rows in two columns for username and passwort
| From: | Karl DeSaulniers | Date: | Thu, 29 Apr 2010 14:44:15 +0000 |
| Subject: | Re: php mysql comparing two rows in two columns for username and passwort | ||
| References: | 1 2 3 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-47097@lists.php.net to get a copy of this message | ||
Yes. You are correct. Did not include that part, sry.
Dont forget mysql_real_escape_string.
:)
Karl
On Apr 29, 2010, at 9:37 AM, Peter Lind wrote:
On 29 April 2010 15:00, Karl DeSaulniers <karl@designdrumm.com> wrote:Karl DeSaulniers Design Drumm http://designdrumm.comHi, Maybe try... $benutzername = $_GET['username']; $pass = $_GET['password']; $result = "SELECT * FROM usertable WHERE sqlbenutzername='$benutzername'";Don't use values from $_GET without sanitizing first. If using mysql_* functions, sanitize with mysql_real_escape_string() first.while($r = mysql_fetch_row($result)) {This would work but only if you're storing passwords in the database in clear text - which is a Bad Thing and should be avoided. Hash the passwords before storing and compare with a hashed version, not the cleartext. Regards Peter --<hype> WWW: http://plphp.dk / http://plind.dk LinkedIn: http://www.linkedin.com/in/plind Flickr: http://www.flickr.com/photos/fake51 BeWelcome: Fake51 Couchsurfing: Fake51 </hype> -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php$dbbenutzer = $r["sqlbenutzername"]; $dbpasswort = $r["sqlpasswort"];}if($benutzername == $dbbenutzer && $pass == $dbpasswort){