note 70578 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: PhatFingers ---- I concur with icydee. It's important that SQL Injection is prevented on the server side. A person (or software) doing SQL Injection on your site will often post to your page from one of his own making. For example, you may present a page like the following on http://examplesite.com/ that sanitizes all data before submitting. <html> <head><script type="text/javascript" src="validation.js" /></head> <body> <form method="POST" action="/login.php"> Name: <input type="text" name="the_acount" value="" /><br/> Password: <input type="password" name="pwd" value="" /><br/> <input type="submit" name="action" value="Submit" onClick="Sanitize()"/> </body> </html> Your attacker views the source code and makes his own login page on his local hard drive. It doesn't have to look like or even load from your page as long as he posts the form data to your site using your expected parameters. <html><body> <form method="POST" action="http://examplesite.com/login.php"> <input type="hidden" name="the_acount" value="1'; drop table users; select 1 where name='" /><br/> Password: <input type="hidden" name="pwd" value="Oh, was I supposed to be hashed?" /><br/> <input type="submit" name="action" value="Submit" /> </body></html>