note 104413 deleted from security.database.sql-injection by danbrown

Note Submitter: no spam at innvo dot com ---- RE: kirby4 at live dot ca 19-Feb-2011 10:35 By performing MD5(columnname) you are losing any potential index use and are performing a full table scan, because the DB has to create a checksum of each and every row. Since you are creating an MD5 to match the column you would circumvent any potential SQL injection anyway, as the output is invariably 32 hexadecimal characters. For your example I prefer to use mysql_real_escape_string and for passwords/binary data, just use MD5 with PHP and something like MySQL's UNHEX();