Re: To check for existing user in database
| From: | Nathan Rixham | Date: | Fri, 16 Jan 2009 16:55:30 +0000 |
| Subject: | Re: To check for existing user in database | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-286507@lists.php.net to get a copy of this message | ||
Eric Butera wrote:
yay - well said eric :)$result = mysql_query($query) or die(mysql_error());You know guys, after seeing all this talk of sql injection over the past few days, I'd also like to point out or die is pretty bad too. Especially when coupled with mysql_error(). It can expose sensitive system info (security vuln) when a simple if (!$result) { show error page } would have worked. I know I laugh and leave whenever I see such an error on some site I stumble across.