note 55379 added to function.mysql-real-escape-string

While I know it is a good idea to always escape these characters, this login method seems to prevent injection attacks by not including the password in the sql query. <?php $username = $_GET['username']; $password = $_GET['password']; $result = mysql_query("select * from users where username = '$username'"); $user = mysql_fetch_array($result); if ($user == "") { echo "Bad user"; exit; } if(($password != $user[password])) { echo "Bad password."; exit; } else { echo "Logged in!"; } ?> ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+55379 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+55379&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+55379&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+55379&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+55379&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+55379&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+55379&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+55379&report=yes Search -- http://master.php.net/manage/user-notes.php