Re: [PHP-DB] Slashes or no slashes

On Aug 23, 2010, at 9:31 PM, Chris wrote:

>
>> To be more specific. Is this correct?
>>
>> function confirmUP($username, $password){
>> $username = mysql_real_escape_string($username);
>>
>> /* Verify that user is in database */
>> $q = "SELECT password FROM TBL-U WHERE username = '$username'";
>
> I normally do it in the query in case you use the variable  
> somewhere else but here it's ok because you don't use $username  
> elsewhere. Be careful though, it may bite you and it will be  
> difficult to track down.
>
> eg
>
> $q = "select password from table where username='" .  
> mysql_real_escape_string($username) . "'";
>
> echo "You entered " . htmlspecialchars($username) . ", either it  
> was wrong or the password was wrong. Try again.";
>
> Doing the escape_string before the query means you end up with  
> (basically)
>
> htmlspecialchars(mysql_real_escape_string($username));
>
> which will cause weird characters to show up in certain cases.
>
>> $result = $this->query($q);
>> if(!$result || (mysql_numrows($result) < 1)){
>> return 1; //Indicates username failure
>> }
>>
>> /* Retrieve password from result */
>> $dbarray = mysql_fetch_array($result);
>> $dbarray['password'] = htmlspecialchars($dbarray['password']);
>> $password = mysql_real_escape_string(md5($password));
>> $password = htmlspecialchars($password);
>
> You're not displaying the password so don't htmlspecialchars it.
>
> Just:
>
> if ($dbarray['password'] == md5($password)) {
>   return 0; // success!
> }
>
> Only specialchars it when you display it (like the echo above).
>
> -- 
> Postgresql & php tutorials
> http://www.designmagick.com/
>
>
> -- 
> PHP Database Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>


Ahhh. I see.
But I do still put the escape on what they entered so it will match  
what is in the database.
Ok. Thank you Thank you Thank you.

Best,

Karl DeSaulniers
Design Drumm
http://designdrumm.com