php - How can i prevent SQL injection when using MySQLi? -

-

this question has answer here:

how prevent sql injections in sql query this?

<?php $mysqli = new mysqli("ip", "username", "pass", "database");  /* check connection */ if (mysqli_connect_errno()) {     printf("sorry, login server 'under maintainance'");     exit(); }  $username = $_post["username1"]; $username = strtolower($username); $password = $_post['password1']; $hash = sha1(strtolower($username) . $password);  $query = "select * accounts name='$username'";  if ($result = $mysqli->query($query)) {     /* determine number of rows result set */     $rownum = $result->num_rows;  if($rownum != 0) { while ($row = $result->fetch_assoc()) {   {   $acct = $row['acct'];   $pass = $row['pass']; } if($hash == $pass){ session_start(); $_session['name']=$username; $_session['acct']=$acct; header('location:index.php'); } else { echo 'there error when logging in. make sure password , username correct.'; } }     $result->close(); } else { echo 'account not exist. please <a href="register.php">register</a> account before logging in.'; }     $mysqli->close(); } ?>

i have added encryption cannot seem find prevention method know how use yet. also, possible user use mysql injection without using input box? (page dissection???)

encryption , query sanitation not related.

you're using mysqli, nice, don't sanitize input query (namely $username, doesn't need strtolowered either).

you should use parameterized queries sanitation.

$query = "select * accounts name = ?"; $stmt = $mysqli->prepare($query); $stmt->bind_param("s", $username); $stmt->execute(); $stmt->bind_result($acct, $pass); $stmt->fetch(); //$act , $pass set

the limits on sql injection have nothing user. it's possible accidentally inject in own code, , injection not have malicious. reason, should always parameterize queries if don't think there's risk of malicious injection.


Comments

Post a Comment

Popular posts from this blog

Perl - how to grep a block of text from a file -

-
it can in xml or text format. how in general grep block of text in perl? <track type="ws"> <range> <rangestart>0</rangestart> <rangeend>146.912</rangeend> <locationindex>0</locationindex> <propertyindex>0</propertyindex> </range> </track> <track type="ps" id="1"> <range> <rangestart>0</rangestart> <rangeend>146.912</rangeend> <locationindex>1</locationindex> <propertyindex>1</propertyindex> </range> </track> i want grep type="ps" , till </range> . one solution open file, read line line , match block. open(fh, "file.txt"); foreach $line (<fh>) { if ($line =~ m/type="cc"(.*?)<\/range>/) { print $1; } } but there more optimal solution without reading file line l
Read more

delphi - How to remove all the grips on a coolbar if I have several coolbands? -

-
Image
if set mycoolbar.fixedorder true,only grip on first band hidden. well,if use delphi 7 create vcl forms application,then put coolbar on , create 3 coolbans hold other controls,only grip , top coolbands can hidden setting mycoolbar.fixedorder:=true. i've uploaded picture make things clear. you got fixedorder property wrong. fixed property not allow bands rearranged if set true . setting property of coolbar true keep user changing bands order @ runtime, user can still move , resize bands. can give advice can do, actual solution problem, well, have wait answer. my advice use 3 coolbars in row , setting "fixedorder" property true , bandborderstyle bsnone . way grip hidden on of them. about property, it's not bug of ide, actual preference of property.
Read more

javascript - Animating array of divs; only the final element is modified -

-
this baffling me @ moment. i'm experienced programmer looking throw bit of surprise fiancee on countdown page our wedding. desired effect simulated confetti falling behind main page. setup follows: i have array of divs in javascript. each div absolutely positioned on page. have interval set updates every 50 or milliseconds. on each tick, run loop on array of divs, , calculations , update positions. problem problem having, however, though can see divs created, stored array, , modified (in case, each has slight randomized rotation) during initialization phase, once tick update position starts, div stored in whatever last slot of array gets position updated. tried hard-coding each div index testing purposes, strictly last element update position. upon printing current "left" , "top" style values each div before , after calculations shows value has been changed, no visible change noticeable. here's basic code: javascript var container;
Read more