note 44357 added to function.mysql-escape-string
| From: | webmaster at strikeholdings dot com | Date: | Tue, 03 Aug 2004 16:51:00 +0000 |
| Subject: | note 44357 added to function.mysql-escape-string | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-73853@lists.php.net to get a copy of this message | ||
Escaping is good, but to prevent the kind of SQL injection attack described in these notes,
disallowing the use of spaces in submitted login names and passwords helps, too.
<?php
if (!empty($_POST["login") && !empty($_POST["password"])) {
$login = str_replace(" ","",$_POST["login"]);
$password = str_replace(" ","",$_POST["password"]);
$query = "SELECT user_id FROM users WHERE login='$login' AND
password='$password'";
etc. etc.
}
?>
----
Manual Page -- http://www.php.net/manual/en/function.mysql-escape-string.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+44357
Delete -- http://master.php.net/manage/user-notes.php?action=delete+44357&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+44357&report=yes
Search -- http://master.php.net/manage/user-notes.php