Re: Code Not entering the value in the Database
| From: | Jan G.B. | Date: | Tue, 20 Jan 2009 14:52:21 +0000 |
| Subject: | Re: Code Not entering the value in the Database | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-286850@lists.php.net to get a copy of this message | ||
2009/1/20 Chris Carter <chandan9sharma@yahoo.com>:
>
> Hi,
>
> My code is not giving error but not doing the desired action.
>
But it can do a lot more than your desired action.
> // insert new entry in the database if entry submitted
>
> $emailAddress = $_POST['emailAddress'];
> $password = $_POST['password'];
> $sql5 = "SELECT * FROM userstable WHERE
> emailAddress='$emailAddress' AND
> password = '$password'";
> $result5=mysql_query($sql5);
Do yourself a favor and read this from A to Z:
http://de3.php.net/manual/en/security.php
Imagine I send the String: x' OR id=1/*
What would the mysql read now?
SELECT * FROM userstable WHERE emailAddress='x' OR id=1/*' AND ...
everything after "/*" is not being parsed.
> header("location:you-need-to-register.php");
correct would be header("location: http://foo/you-need-to-register.php");
> What exactly am I missing.
http://php.net/docs.php
Byebye