Re: Slashes or no slashes

On Aug 23, 2010, at 10:04 PM, Karl DeSaulniers wrote:

On Aug 23, 2010, at 9:31 PM, Chris wrote:

To be more specific. Is this correct? function confirmUP($username, $password){ $username = mysql_real_escape_string($username); /* Verify that user is in database */ $q = "SELECT password FROM TBL-U WHERE username = '$username'";

I normally do it in the query in case you use the variable somewhere else but here it's ok because you don't use $username elsewhere. Be careful though, it may bite you and it will be difficult to track down. eg $q = "select password from table where username='" . mysql_real_escape_string($username) . "'"; echo "You entered " . htmlspecialchars($username) . ", either it was wrong or the password was wrong. Try again."; Doing the escape_string before the query means you end up with (basically) htmlspecialchars(mysql_real_escape_string($username)); which will cause weird characters to show up in certain cases.

$result = $this->query($q); if(!$result || (mysql_numrows($result) < 1)){ return 1; //Indicates username failure } /* Retrieve password from result */ $dbarray = mysql_fetch_array($result); $dbarray['password'] = htmlspecialchars($dbarray['password']); $password = mysql_real_escape_string(md5($password)); $password = htmlspecialchars($password);

You're not displaying the password so don't htmlspecialchars it. Just: if ($dbarray['password'] == md5($password)) { return 0; // success! } Only specialchars it when you display it (like the echo above). --Postgresql & php tutorials http://www.designmagick.com/ --PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Ahhh. I see. But I do still put the escape on what they entered so it will match what is in the database. Ok. Thank you Thank you Thank you. Best, Karl DeSaulniers Design Drumm http://designdrumm.com --PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Just to make sure, cause I am ready to get past this. Is this correct? function confirmUP($username, $password){ /* Verify that user is in database */

      $q = "SELECT password FROM ".TBL_USERS." WHERE username = '".mysql_real_escape_string($username)."'";
      $result = $this->query($q);
      if(!$result || (mysql_numrows($result) < 1)){
         return 1; //Indicates username failure
      }

      /* Retrieve password from result */
      $dbarray = mysql_fetch_array($result);
      $dbarray['password'] = htmlspecialchars($dbarray['password']); //Or is this where I need to leave htmlspecialchars off too?

      /* Validate that password is correct */
      if(md5($password) == $dbarray['password']){
         return 0; //Success! Username and password confirmed
      }
      else{
         return 2; //Indicates password failure
      }

} Karl DeSaulniers Design Drumm http://designdrumm.com