note 69902 added to function.mysql-real-escape-string

In order to avoid SQL injection the most efficient way is to encrypt the password on the client side using javascript hashing algorithm ( a modified MD5, or other ) that accepts a randomly generated sequence of characters every time the user displays the page ( body onBlur = "generate_random_sequence" ). In this way the hash will be different every time the user logs on ( to avoid packet sniffing ). On the server side all you need to do is to $password_from_db = sql_query( SELECT password FROM users WHERE user = $_POST["the_acount"] ); $srvsidehash = Algorithm( $password_from_db, $_POST["client_side_generated_sequence"]); if $_POST["password_hashed"] = $srvsidehash then the_acount had supplied a correct password;all ok; else Die(' use_id or password error'); The difficult part is to reproduce the javascript algorithm on the server side. Sorry for not posting some real code. ---- Server IP: 217.174.203.10 Probable Submitter: 87.88.254.17 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/69902 Del: integrated -- https://master.php.net/note/delete/69902/integrated Del: useless -- https://master.php.net/note/delete/69902/useless Del: bad code -- https://master.php.net/note/delete/69902/bad+code Del: spam -- https://master.php.net/note/delete/69902/spam Del: non-english -- https://master.php.net/note/delete/69902/non-english Del: in docs -- https://master.php.net/note/delete/69902/in+docs Del: other reasons-- https://master.php.net/note/delete/69902 Reject -- https://master.php.net/note/reject/69902 Search -- https://master.php.net/manage/user-notes.php