note 103229 added to function.mysql-real-escape-string

<?php /*Another not in regard to injections // We didn't check $_POST['password'], it could be anything the user wanted! For example: $_POST['username'] = 'aidan'; $_POST['password'] = "' OR ''='"; */ //You could escape directly $username = mysql_real_escape_string($_POST['username']); $password = mysql_real_escape_string($_POST['password']); //It's a better practice to hash a password than storing cleartext. $password = md5($_POST['password']); //The hash would prevent the passing of an injection. /*Rather than running an untested query on the database it's a good practice to perform a count on the query values ahead of time before a select or an insert.*/ $query1 = "SELECT count(*) FROM users WHERE user='$username' AND password='$password';"; $result1 = mysql_result(mysql_query($query1),0); if ($result1=='1'){ $query2 = "SELECT * FROM users WHERE user='$username' AND password='$password';"; $result2 = mysql_query($query2); } else { exit(); } ---- Server IP: 69.147.83.197 Probable Submitter: 68.60.243.140 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/103229 Del: integrated -- https://master.php.net/note/delete/103229/integrated Del: useless -- https://master.php.net/note/delete/103229/useless Del: bad code -- https://master.php.net/note/delete/103229/bad+code Del: spam -- https://master.php.net/note/delete/103229/spam Del: non-english -- https://master.php.net/note/delete/103229/non-english Del: in docs -- https://master.php.net/note/delete/103229/in+docs Del: other reasons-- https://master.php.net/note/delete/103229 Reject -- https://master.php.net/note/reject/103229 Search -- https://master.php.net/manage/user-notes.php