svn: /phpdoc/en/trunk/reference/mysql/functions/ mysql-real-escape-string.xml
| From: | David Tajchreber | Date: | Sun, 20 Feb 2011 22:41:18 +0000 |
| Subject: | svn: /phpdoc/en/trunk/reference/mysql/functions/ mysql-real-escape-string.xml | ||
| Groups: | php.doc.cvs | ||
| Request: | Send a blank email to doc-cvs+get-7797@lists.php.net to get a copy of this message | ||
dtajchreber Sun, 20 Feb 2011 22:41:18 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=308511
Log:
bug #54041 - http post vars are set before processing. changed order to make example give shown
output
Bug: http://bugs.php.net/54041 (Open)
mysql_real_escape_string
Changed paths:
U phpdoc/en/trunk/reference/mysql/functions/mysql-real-escape-string.xml
Modified: phpdoc/en/trunk/reference/mysql/functions/mysql-real-escape-string.xml
===================================================================
--- phpdoc/en/trunk/reference/mysql/functions/mysql-real-escape-string.xml 2011-02-20 19:44:08 UTC
(rev 308510)
+++ phpdoc/en/trunk/reference/mysql/functions/mysql-real-escape-string.xml 2011-02-20 22:41:18 UTC
(rev 308511)
@@ -83,14 +83,14 @@
<programlisting role="php">
<![CDATA[
<?php
+// We didn't check $_POST['password'], it could be anything the user wanted! For
example:
+$_POST['username'] = 'aidan';
+$_POST['password'] = "' OR ''='";
+
// Query database to check if there are any matching users
$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND
password='{$_POST['password']}'";
mysql_query($query);
-// We didn't check $_POST['password'], it could be anything the user wanted! For
example:
-$_POST['username'] = 'aidan';
-$_POST['password'] = "' OR ''='";
-
// This means the query sent to MySQL would be:
echo $query;
?>