note 123597 added to mysqli.real-query

Well, we don't know if $password is in plain text because it was never defined in the example. New passwords should be stored using <?php $crypt_pass = password_hash($password, PASSWORD_DEFAULT); ?> Where PASSWORD_DEFAULT = BCRYPT algorithm Then to compare a user entered password to a database stored password, we use: <?php $valid = password_verify($password, $crypt_pass); ?> Which returns true or false. As for being vulnerable to injection, this is true. To avoid this, use sprintf() or vsprintf() to format the query and inject the values using mysqli::real_escape_string, like so: <?php $vals = [$db->real_escape_string($username), $db->real_escape_string($password)]; $query = vsprintf("Select * From users Where username='%s' And password='%s'", $vals); $result = $db->real_query($query); ?> ---- Server IP: 208.43.231.9 Probable Submitter: 82.199.157.35 (proxied: 68.185.188.217) ---- Manual Page -- http://php.net/manual/en/mysqli.real-query.php Edit -- https://master.php.net/note/edit/123597 Del: integrated -- https://master.php.net/note/delete/123597/integrated Del: useless -- https://master.php.net/note/delete/123597/useless Del: bad code -- https://master.php.net/note/delete/123597/bad+code Del: spam -- https://master.php.net/note/delete/123597/spam Del: non-english -- https://master.php.net/note/delete/123597/non-english Del: in docs -- https://master.php.net/note/delete/123597/in+docs Del: other reasons-- https://master.php.net/note/delete/123597 Reject -- https://master.php.net/note/reject/123597 Search -- https://master.php.net/manage/user-notes.php