protection 2
| From: | Ross | Date: | Wed, 17 Jan 2007 12:04:36 +0000 |
| Subject: | protection 2 | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-247208@lists.php.net to get a copy of this message | ||
Thanks Colin.
Think I will do both. I can timeout the session with PHP.
Does adding mysql_real_escape_string make this secure to injection or should
I be doing something else?
if ($_POST['submitted']){
$username = mysql_real_escape_string( $_POST['username'] );
$pass = mysql_real_escape_string( $_POST['pass');
$username = md5($username);
$pass = md5($pass);
$query = "SELECT username, pass FROM login where username='$username' AND
pass ='$pass'";