Re: To check for existing user in database
| From: | Eric Butera | Date: | Fri, 16 Jan 2009 16:53:28 +0000 |
| Subject: | Re: To check for existing user in database | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-286506@lists.php.net to get a copy of this message | ||
> $result = mysql_query($query) or die(mysql_error());
You know guys, after seeing all this talk of sql injection over the
past few days, I'd also like to point out or die is pretty bad too.
Especially when coupled with mysql_error(). It can expose sensitive
system info (security vuln) when a simple if (!$result) { show error
page } would have worked. I know I laugh and leave whenever I see
such an error on some site I stumble across.