Re: Trying to understand sessions and using them to authenticate...
| From: | Daniel Brown | Date: | Fri, 24 Aug 2007 17:35:22 +0000 |
| Subject: | Re: Trying to understand sessions and using them to authenticate... | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-261247@lists.php.net to get a copy of this message | ||
On 8/24/07, Borokov Smith <borokov@gmail.com> wrote:
[snip]
> A warrant about your example not being validated, will most likely not
> stop the OP from using this code as is, thereby subjecting himself to
> SQL injection.
> And all it needed was mysql_real_escape_string() in there.
>
>
Kinda' like this part, right?
[snip]
> if($_POST['user'] && $_POST['pass']) { // Keep in mind, PASSWORD
> has meaning in MySQL
> // Do your string sanitizing here
> // (e.g. - $user = mysql_real_escape_string($_POST['user']);)
> $sql = "SELECT * FROM users WHERE user='".$user."' AND
> pass='".$pass."' LIMIT 0,1;";
[/snip]
--
Daniel P. Brown
[office] (570-) 587-7080 Ext. 272
[mobile] (570-) 766-8107
Hey, PHP-General list....
50% off for life on web hosting plans $10/mo. or more at
http://www.pilotpig.net/.
Use the coupon code phpgeneralaug07
Register domains for about $0.01 more than what it costs me at
http://domains.pilotpig.net/.