note 70226 deleted from function.mysql-real-escape-string by mazzanet
| From: | mazzanet@php.net | Date: | Thu, 23 Nov 2006 08:53:07 +0000 |
| Subject: | note 70226 deleted from function.mysql-real-escape-string by mazzanet | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-120016@lists.php.net to get a copy of this message | ||
Note Submitter: icydee
----
codures seems to have missed the point. Even doing client side hashing does not remove the need for
server side injection protection in all cases. His example only protects against injection in the
password field but does not protect against attacks using the 'the_acount' field.
$password_from_db = sql_query( SELECT password FROM users WHERE user =
$_POST["the_acount"] );