note 55379 deleted from function.mysql-real-escape-string by nlopess
| From: | nlopess@php.net | Date: | Mon, 01 Aug 2005 20:56:17 +0000 |
| Subject: | note 55379 deleted from function.mysql-real-escape-string by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-92891@lists.php.net to get a copy of this message | ||
Note Submitter: buck at stoplookingatmyass dot com
----
While I know it is a good idea to always escape these characters, this login method seems to prevent
injection attacks by not including the password in the sql query.
<?php
$username = $_GET['username'];
$password = $_GET['password'];
$result = mysql_query("select * from users where username = '$username'");
$user = mysql_fetch_array($result);
if ($user == "") {
echo "Bad user";
exit;
}
if(($password != $user[password])) {
echo "Bad password.";
exit;
}
else
{
echo "Logged in!";
}
?>