note 105119 rejected from function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Thu, 28 Jul 2011 19:05:36 +0000 |
| Subject: | note 105119 rejected from function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-181965@lists.php.net to get a copy of this message | ||
Note Submitter: shirkkan at hotmail dot com
----
Would it be enough to do something like this to prevent the sql injection?
$name = md5($POST['name']);
$pwd = md5($POST['pwd']);
"select * from users where MD5(name) = '$name' AND pwd ='$pwd' "
Note: pwd is stored in DB as the md5 of the original password.