note 69902 deleted from function.mysql-real-escape-string by mazzanet

Note Submitter: codures at email dot ro ---- In order to avoid SQL injection the most efficient way is to encrypt the password on the client side using javascript hashing algorithm ( a modified MD5, or other ) that accepts a randomly generated sequence of characters every time the user displays the page ( body onBlur = "generate_random_sequence" ). In this way the hash will be different every time the user logs on ( to avoid packet sniffing ). On the server side all you need to do is to $password_from_db = sql_query( SELECT password FROM users WHERE user = $_POST["the_acount"] ); $srvsidehash = Algorithm( $password_from_db, $_POST["client_side_generated_sequence"]); if $_POST["password_hashed"] = $srvsidehash then the_acount had supplied a correct password;all ok; else Die(' use_id or password error'); The difficult part is to reproduce the javascript algorithm on the server side. Sorry for not posting some real code.