note 93674 deleted from security.database.sql-injection by danbrown
| From: | danbrown@php.net | Date: | Tue, 22 Sep 2009 15:03:00 +0000 |
| Subject: | note 93674 deleted from security.database.sql-injection by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-160938@lists.php.net to get a copy of this message | ||
Note Submitter: callix
----
To limit the risk of SQL injection when validating user/password, good practice (after sanitizing
the user name) is to retrieve the password with the query and validate it in php, as opposed to
using it in the WHERE clause:
<?php
$l_user = addslashes($user);
$l_pwd = addslashes($pwd);
$query = "SELECT password FROM usertable WHERE username='$l_user'";
/*
Execute query with appropriate db function
...
Retrieve password field into $password with appropriate db function
*/
if($password != md5($l_pwd)) {
die("You fool!");
}
echo "Welcome!"
...
?>