note 96132 added to function.convert-uuencode

Hi there. Don't follow the example given by <i>Vipindas K.S</i> on 08-May-2008 04:42. The Username is taken straight from the User and is not escaped. This opens a mysql injection possibility. There's NO benefit in saving an uuencoded Password. Be smart. <?php $query = "INSERT INTO foo (user, name) VALUES ('".mysql_real_escape_string($_POST['username'])."', '".md5('SeCREt'.$_POST['password'])."')"; ?> ---- Server IP: 69.147.83.197 Probable Submitter: 84.188.238.222 ---- Manual Page -- http://www.php.net/manual/en/function.convert-uuencode.php Edit -- https://master.php.net/note/edit/96132 Del: integrated -- https://master.php.net/note/delete/96132/integrated Del: useless -- https://master.php.net/note/delete/96132/useless Del: bad code -- https://master.php.net/note/delete/96132/bad+code Del: spam -- https://master.php.net/note/delete/96132/spam Del: non-english -- https://master.php.net/note/delete/96132/non-english Del: in docs -- https://master.php.net/note/delete/96132/in+docs Del: other reasons-- https://master.php.net/note/delete/96132 Reject -- https://master.php.net/note/reject/96132 Search -- https://master.php.net/manage/user-notes.php