note 63950 rejected from function.mysql-real-escape-string by bjori
| From: | bjori@php.net | Date: | Tue, 04 Apr 2006 18:08:42 +0000 |
| Subject: | note 63950 rejected from function.mysql-real-escape-string by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-107318@lists.php.net to get a copy of this message | ||
Note Submitter: mathieu at claroline dot net
----
You cannot handle the NULL value
if $_POST['username'] is null, this query failed :
<?php
$query = sprintf("SELECT * FROM users WHERE user=%s AND password=%s",
quote_smart($_POST['username']),
quote_smart($_POST['password']));
?>
Because "... WHERE user = NULL ..." is not valid in sql, the good statement is "...
WHERE user IS NULL ..."