note 70226 added to function.mysql-real-escape-string
| From: | icydee at osu1 dot php dot net | Date: | Sat, 07 Oct 2006 09:48:34 +0000 |
| Subject: | note 70226 added to function.mysql-real-escape-string | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-118182@lists.php.net to get a copy of this message | ||
codures seems to have missed the point. Even doing client side hashing does not remove the need for
server side injection protection in all cases. His example only protects against injection in the
password field but does not protect against attacks using the 'the_acount' field.
$password_from_db = sql_query( SELECT password FROM users WHERE user =
$_POST["the_acount"] );
----
Server IP: 85.116.0.130
Probable Submitter: 82.70.164.174
----
Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php
Edit -- https://master.php.net/note/edit/70226
Del: integrated -- https://master.php.net/note/delete/70226/integrated
Del: useless -- https://master.php.net/note/delete/70226/useless
Del: bad code -- https://master.php.net/note/delete/70226/bad+code
Del: spam -- https://master.php.net/note/delete/70226/spam
Del: non-english -- https://master.php.net/note/delete/70226/non-english
Del: in docs -- https://master.php.net/note/delete/70226/in+docs
Del: other reasons-- https://master.php.net/note/delete/70226
Reject -- https://master.php.net/note/reject/70226
Search -- https://master.php.net/manage/user-notes.php