note 70104 deleted from function.mysql-real-escape-string by aidan

Note Submitter: IVIaniac ---- To aide in the simplicity of things, I try and validate the information before it is even queried to the MySQL server. For example. With usernames and passwords, I check for spaces. And ; signs. If either of these are in there, then the login request is ignored, since I do not allow either during registration. So a simple attack like: 1 or 1=1 Isn't even sent. Instead a "Please check username / password and try again" message is displayed. I display the same message when the query is ignored as I do when an invalid login is parsed. As to not "challenge" the attacker. Make them think simply it was an invalide username/password, rather than a big deal like die("Hacking attempt!!!"); You could very easily implement logging to keep track of malicious IP's and what-not as well.