Re: nooB PhP login using MySQL

Message-ID: <memo.20070330102052.1440B@xxxxxxxxxxxxxxxxxxxxx> from Rafe
Culpin contained the following:

The process is to take the supplied username and password and do a
database query to see if there is a row containing that combination. Of
course, this presupposes that you ensured that the combination was
unique before storing in the database. If a row is found the log in is
successful.

*IMPORTANT*
Before doing this and putting it on a public site, google "SQL injection
attack" (with quotes) and make sure you understand the implications and
have guarded against them. If you do not do this an attacker can run
arbitrary SQL commands on your database.

Quite, I only intended to give an overview. No user input should be
trusted. The use of mysql_real_escape_string is now second nature to me
and I forgot to mention it.
--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/
.

Relevant Pages

  • Re: How to properly manage a custom profile?
    ... Besides, use fuckin' gmail, it ... effort to extort money out of them by saying they'll continue to attack ... Why would anyone want to put an IP in a database, ... Clearly evidenced by your paranoid delusions. ...
    (comp.os.linux.setup)
  • Re: Analyze this Game
    ... that database have? ... Strong players like GM Alekhine have played ... in which White players try to "attack" desperately, ... and most of the recent games I found ...
    (rec.games.chess.computer)
  • RE: FUD - was FAX a virus
    ... Security is a risk function as I have stated time and ... In relation to the sending of faxed data, being OCR'd into a database, I ... manner or method in which a fax stream could be used to administer the ... To attack Oracle over a data stream such as was mentioned in the ...
    (Security-Basics)
  • Re: SQL Injection
    ... A "best practice" solution has been partially discussed. ... the input from executing on the database. ... server which they will use to create a more advanced attack. ... > Dim prm As SqlParameter ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: [PHP] SQL Injections
    ... > $_POST values sent from a page don't include any SQL? ... executed by your database. ... different way of escaping data. ... you basically make yourself vulnerable to every type of attack ...
    (php.general)