note 96132 deleted from function.convert-uuencode by danbrown
| From: | danbrown@php.net | Date: | Wed, 10 Feb 2010 14:39:11 +0000 |
| Subject: | note 96132 deleted from function.convert-uuencode by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-165829@lists.php.net to get a copy of this message | ||
Note Submitter: Anonymous
----
Hi there.
Don't follow the example given by <i>Vipindas K.S</i> on 08-May-2008 04:42.
The Username is taken straight from the User and is not escaped. This opens a mysql injection
possibility. There's NO benefit in saving an uuencoded Password.
Be smart.
<?php
$query = "INSERT INTO foo (
user, name) VALUES
('".mysql_real_escape_string($_POST['username'])."',
'".md5('SeCREt'.$_POST['password'])."')";
?>