Is this secure?

[Kristopher]

<?php
$sql = "SELECT * FROM users";

$result = mysql_query($sql);

while ($row = mysql_fetch_assoc($result)) {
echo $row["username"];
}

?>

 

[Markshall]

Yes it is, you're not allowing the user to input anything in to the database, you're just echoing an output.

Just make sure that you sanitize the inputs to the database when the user is signing up. If, for example when they are signing up and they choose the username '<script type="text/javascript">alert('hi');</script>', and you don't sanitize it, it will enter that whole JavaScript code into the database, then when you come to echo out the username from the database, it will process that code and render a JavaScript alert dialog box saying "hi".

 

[RastaLulz]

You shouldn't sanitize data that is being put in your database, you should sanitize the data coming out of the database. That way your data is pure, and not messed up because your script doesn't take care of it.

 

[Markshall]

You shouldn't sanitize data that is being put in your database, you should sanitize the data coming out of the database. That way your data is pure, and not messed up because your script doesn't take care of it.

Yeah exactly, I meant that but got mixed up.

A nice way I like to sanitize my data from databases is this:

public function Arr($sql) {
    $query = @mysql_fetch_array($sql);
    if (!$query) {
        die("Query failed");
    }
    return array_map("stripslashes", $query);
}

You can add more functions to the array_map function by just creating an array of functions inside the first parameter,

You must be registered for see links

 

[Kristopher]

It pulls all the usernames from the db... How can i make it pull the username thats has its current session?

 

[Markshall]

It depends how you check if a user is logged in.

Download

You must be registered for see links

and have a look how I did it if you like.

 

[Kristopher]

It depends how you check if a user is logged in.

Download

You must be registered for see links

and have a look how I did it if you like.

Well its RevCMS, I'm attempting to make a better homes then what is already released.. But It won't be release its just to better my skills..