Re: [PHP-DB] Slashes or no slashes

> Just to make sure, cause I am ready to get past this.
> Is this correct?
>
> function confirmUP($username, $password){
> /* Verify that user is in database */
> $q = "SELECT password FROM ".TBL_USERS." WHERE username =
> '".mysql_real_escape_string($username)."'";

Perfect.

> /* Retrieve password from result */
> $dbarray = mysql_fetch_array($result);
> $dbarray['password'] = htmlspecialchars($dbarray['password']); //Or is
> this where I need to leave htmlspecialchars off too?

Leave it off.

You're not displaying $dbarray['password'] here - so you don't need to 
use htmlspecialchars.

-- 
Postgresql & php tutorials
http://www.designmagick.com/