Re: [PHP-DB] Slashes or no slashes

> To be more specific. Is this correct?
>
> function confirmUP($username, $password){
> $username = mysql_real_escape_string($username);
>
> /* Verify that user is in database */
> $q = "SELECT password FROM TBL-U WHERE username = '$username'";

I normally do it in the query in case you use the variable somewhere 
else but here it's ok because you don't use $username elsewhere. Be 
careful though, it may bite you and it will be difficult to track down.

eg

$q = "select password from table where username='" . 
mysql_real_escape_string($username) . "'";

echo "You entered " . htmlspecialchars($username) . ", either it was 
wrong or the password was wrong. Try again.";

Doing the escape_string before the query means you end up with (basically)

htmlspecialchars(mysql_real_escape_string($username));

which will cause weird characters to show up in certain cases.

> $result = $this->query($q);
> if(!$result || (mysql_numrows($result) < 1)){
> return 1; //Indicates username failure
> }
>
> /* Retrieve password from result */
> $dbarray = mysql_fetch_array($result);
> $dbarray['password'] = htmlspecialchars($dbarray['password']);
> $password = mysql_real_escape_string(md5($password));
> $password = htmlspecialchars($password);

You're not displaying the password so don't htmlspecialchars it.

Just:

if ($dbarray['password'] == md5($password)) {
   return 0; // success!
}

Only specialchars it when you display it (like the echo above).

-- 
Postgresql & php tutorials
http://www.designmagick.com/