|
Posted by Michael Fesser on 12/29/07 00:33
..oO(jpyers@gmail.com)
>$result=mysql_query("SELECT * FROM members
>WHERE username="$_POST[username]"");
>
>Your quotes are messed up, doing what sskaje said should fix your
>problem.
>
>$result = mysql_query("SELECT * FROM members WHERE username=`
>$_POST['username']`");
>
>That should fix your problem.
Nope. It will cause a parse error because of the single-quoted array
index inside of a double-quoted string. Additionally it will cause an
SQL error because a backtick (`) is not a valid string delimiter.
Correct:
$result = mysql_query("
SELECT *
FROM members
WHERE username = '$_POST[username]'
");
or
$result = mysql_query("
SELECT *
FROM members
WHERE username = '{$_POST['username']}'
");
Of course this won't fix the SQL injection problem ...
Micha
Navigation:
[Reply to this message]
|