Re: Trying to understand sessions and using them to authenticate...

From:	Borokov Smith	Date:	Fri, 24 Aug 2007 21:37:17 +0000
Subject:	Re: Trying to understand sessions and using them to authenticate...
References:	1 2 3 4	Groups:	php.general
Request:	Send a blank email to php-general+get-261255@lists.php.net to get a copy of this message

Daniel Brown schreef:

On 8/24/07, Borokov Smith <borokov@gmail.com> wrote: [snip]
A warrant about your example not being validated, will most likely not stop the OP from using this code as is, thereby subjecting himself to SQL injection. And all it needed was mysql_real_escape_string() in there.
    
Kinda' like this part, right? [snip]
if($_POST['user'] && $_POST['pass']) { // Keep in mind, PASSWORD has meaning in MySQL
        // Do your string sanitizing here
        // (e.g. - $user = mysql_real_escape_string($_POST['user']);)
        $sql = "SELECT * FROM users WHERE user='".$user."' AND
pass='".$pass."' LIMIT 0,1;";
    
[/snip] Exactly what I was talking about.

Sorry dude :) greetz, boro