note 63950 added to function.mysql-real-escape-string

You cannot handle the NULL value if $_POST['username'] is null, this query failed : <?php $query = sprintf("SELECT * FROM users WHERE user=%s AND password=%s", quote_smart($_POST['username']), quote_smart($_POST['password'])); ?> Because "... WHERE user = NULL ..." is not valid in sql, the good statement is "... WHERE user IS NULL ..." ---- Server IP: 82.146.33.222 Probable Submitter: 80.200.241.104 ---- X-Spam-Status: No, hits=3.8 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER, UPPERCASE_25_50 autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/note/edit/63950 Del: integrated -- http://master.php.net/note/delete/63950/integrated Del: useless -- http://master.php.net/note/delete/63950/useless Del: bad code -- http://master.php.net/note/delete/63950/bad+code Del: spam -- http://master.php.net/note/delete/63950/spam Del: non-english -- http://master.php.net/note/delete/63950/non-english Del: in docs -- http://master.php.net/note/delete/63950/in+docs Del: other reasons-- http://master.php.net/note/delete/63950 Reject -- http://master.php.net/note/reject/63950 Search -- http://master.php.net/manage/user-notes.php