Reply to thread

Message

<blockquote data-quote="RastaLulz" data-source="post: 345175" data-attributes="member: 1">I'm not sure why you have &quot;value-x&quot; in your query, since you're not bind params or anything? You need to put the actual variable there that is assigned to some data.Also, as mentioned above, you should NOT be using mysql_* functions, and when you do switch to mysqli or PDO, make sure that you bind params, as opposed to put the data directly in the query. Also, if you're not modifying the the data posted, you don't really have to redefine them. You also don't have to include things like &quot;id&quot; into your insert query, as MySQL assigns that automatically.Here's an example of a secure way of using PDO:[PHP]&lt;?phpif (isset($_POST['submit'])){&nbsp; &nbsp; if (empty($_POST['email']) || empty($_POST['pass']))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; echo 'You must enter an email and password.';&nbsp; &nbsp; }&nbsp; &nbsp; else&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; $PDO = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');&nbsp; &nbsp; &nbsp; &nbsp; $query = $PDO-&gt;prepare('SELECT * FROM `php_users_login` WHERE `email` = :email');&nbsp; &nbsp; &nbsp; &nbsp; $query-&gt;excute([&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'email' =&gt; $_POST['email'],&nbsp; &nbsp; &nbsp; &nbsp; ]);&nbsp; &nbsp; &nbsp; &nbsp; if ($query-&gt;rowCount() &gt;= 1)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo 'Sorry, but that email is already being used.';&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $query = $PDO-&gt;prepare('INSERT INTO `php_users_login` (`email`, `password`, `name`, `phone`, `content`, `last_login`) VALUES (:email, :password, :name, :phone, :content, :last_login)');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $query-&gt;execute([&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'email'&nbsp; &nbsp; &nbsp; =&gt; $_POST['email'],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'password'&nbsp;&nbsp; =&gt; $_POST['pass'],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'name'&nbsp; &nbsp; &nbsp;&nbsp; =&gt; $_POST['name'],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'phone'&nbsp; &nbsp; &nbsp; =&gt; $_POST['phone'],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'content'&nbsp; &nbsp; =&gt; $_POST['content'],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'last_login' =&gt; time(),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ]);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /**&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * You can also bind params like this if you want&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * to be more strict with what type of content you&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * allow, like integers, strings, etc.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; *&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * $query-&gt;bindParam('email',&nbsp; &nbsp; &nbsp; $_POST['email'],&nbsp; &nbsp; PDO::PARAM_STR, 50);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * $query-&gt;bindParam('password',&nbsp;&nbsp; $_POST['password'], PDO::PARAM_STR, 250);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * $query-&gt;bindParam('name',&nbsp; &nbsp; &nbsp;&nbsp; $_POST['name'],&nbsp; &nbsp;&nbsp; PDO::PARAM_STR, 30);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * $query-&gt;bindParam('phone',&nbsp; &nbsp; &nbsp; $_POST['phone'],&nbsp; &nbsp; PDO::PARAM_INT, 11);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * $query-&gt;bindParam('content',&nbsp; &nbsp; $_POST['content'],&nbsp; PDO::PARAM_STR, 1000);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * $query-&gt;bindParam('last_login', time());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; *&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; * $query-&gt;execute();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo 'Account should have been created.';&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}[/PHP]Please note that the code above is not tested.Also, keep in mind that bind params protects you from things like SQL injections, but is does NOT protect you from things like XSS attacks. The point being, never trust the data that the user gives you, and always validate it, and when displaying it, make sure that you use a function like &quot;<a href="http://php.net/manual/en/function.htmlentities.php" target="_blank">htmlentities()</a>&quot;.</blockquote>

[QUOTE="RastaLulz, post: 345175, member: 1"] I'm not sure why you have "value-x" in your query, since you're not bind params or anything? You need to put the actual variable there that is assigned to some data. Also, as mentioned above, you should [B]NOT[/B] be using mysql_* functions, and when you do switch to mysqli or PDO, make sure that you bind params, as opposed to put the data directly in the query. Also, if you're not modifying the the data posted, you don't really have to redefine them. You also don't have to include things like "id" into your insert query, as MySQL assigns that automatically. Here's an example of a secure way of using PDO: [PHP]<?php if (isset($_POST['submit'])) { if (empty($_POST['email']) || empty($_POST['pass'])) { echo 'You must enter an email and password.'; } else { $PDO = new PDO('mysql:host=localhost;dbname=database', 'username', 'password'); $query = $PDO->prepare('SELECT * FROM `php_users_login` WHERE `email` = :email'); $query->excute([ 'email' => $_POST['email'], ]); if ($query->rowCount() >= 1) { echo 'Sorry, but that email is already being used.'; } else { $query = $PDO->prepare('INSERT INTO `php_users_login` (`email`, `password`, `name`, `phone`, `content`, `last_login`) VALUES (:email, :password, :name, :phone, :content, :last_login)'); $query->execute([ 'email' => $_POST['email'], 'password' => $_POST['pass'], 'name' => $_POST['name'], 'phone' => $_POST['phone'], 'content' => $_POST['content'], 'last_login' => time(), ]); /** * You can also bind params like this if you want * to be more strict with what type of content you * allow, like integers, strings, etc. * * $query->bindParam('email', $_POST['email'], PDO::PARAM_STR, 50); * $query->bindParam('password', $_POST['password'], PDO::PARAM_STR, 250); * $query->bindParam('name', $_POST['name'], PDO::PARAM_STR, 30); * $query->bindParam('phone', $_POST['phone'], PDO::PARAM_INT, 11); * $query->bindParam('content', $_POST['content'], PDO::PARAM_STR, 1000); * $query->bindParam('last_login', time()); * * $query->execute(); */ echo 'Account should have been created.'; } } }[/PHP] [I]Please note that the code above is not tested. [/I] Also, keep in mind that bind params protects you from things like SQL injections, but is does [B]NOT[/B] protect you from things like XSS attacks. The point being, never trust the data that the user gives you, and always validate it, and when displaying it, make sure that you use a function like "[URL='http://php.net/manual/en/function.htmlentities.php']htmlentities()[/URL]". [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members