note 44357 deleted from function.mysql-escape-string by tomsommer
| From: | tomsommer@php.net | Date: | Tue, 03 Aug 2004 16:53:47 +0000 |
| Subject: | note 44357 deleted from function.mysql-escape-string by tomsommer | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-73854@lists.php.net to get a copy of this message | ||
Note Submitter: webmaster@strikeholdings.com
----
Escaping is good, but to prevent the kind of SQL injection attack described in these notes,
disallowing the use of spaces in submitted login names and passwords helps, too.
<?php
if (!empty($_POST["login") && !empty($_POST["password"])) {
$login = str_replace(" ","",$_POST["login"]);
$password = str_replace(" ","",$_POST["password"]);
$query = "SELECT user_id FROM users WHERE login='$login' AND
password='$password'";
etc. etc.
}
?>