Re: 2nd Pair of eyes
| From: | Richard Quadling | Date: | Tue, 18 Jan 2011 18:04:03 +0000 |
| Subject: | Re: 2nd Pair of eyes | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-310842@lists.php.net to get a copy of this message | ||
On 18 January 2011 17:49, Donovan Brooke <lists@euca.us> wrote:
> $query = "SELECT u_id FROM cms_users WHERE u_name = $_post['f_user'] AND
> u_pass = $_post['f_pass']";
Make sure you clean the inputs before using them.
If the username entered was ...
'' OR 1 --
you may have problems with security.
--
Richard Quadling
Twitter : EE : Zend
@RQuadling : e-e.com/M_248814.html : bit.ly/9O8vFY