note 104413 added to security.database.sql-injection

RE: kirby4 at live dot ca 19-Feb-2011 10:35 By performing MD5(columnname) you are losing any potential index use and are performing a full table scan, because the DB has to create a checksum of each and every row. Since you are creating an MD5 to match the column you would circumvent any potential SQL injection anyway, as the output is invariably 32 hexadecimal characters. For your example I prefer to use mysql_real_escape_string and for passwords/binary data, just use MD5 with PHP and something like MySQL's UNHEX(); ---- Server IP: 69.147.83.197 Probable Submitter: 86.131.165.139 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/104413 Del: integrated -- https://master.php.net/note/delete/104413/integrated Del: useless -- https://master.php.net/note/delete/104413/useless Del: bad code -- https://master.php.net/note/delete/104413/bad+code Del: spam -- https://master.php.net/note/delete/104413/spam Del: non-english -- https://master.php.net/note/delete/104413/non-english Del: in docs -- https://master.php.net/note/delete/104413/in+docs Del: other reasons-- https://master.php.net/note/delete/104413 Reject -- https://master.php.net/note/reject/104413 Search -- https://master.php.net/manage/user-notes.php