Jump to content

PaulM

Members
  • Posts

    1
  • Joined

  • Last visited

PaulM's Achievements

Newbie

Newbie (1/14)

0

Reputation

  1. Also, you should be aware of this security flaw called Sql Injection. Using your current method I could easily insert into your sign up form (or potentially log-in form as well) the following: '; DROP TABLE USERS; ' or 1=1 The first causing your users table to drop (if it existed) and the second would likely log me into the first user (typically the admin's account). These are both bad. In order to prevent this, and to make coding easier, look into prepared statements. It looks like you are using PHP so a prepared statement would be as follows: $stmt = $dbVar->prepare("INSERT INTO `$tbl1`('uid', 'user', 'fname', 'lname', 'gender', 'dob', 'login', 'password', 'ip', 'device', 'date', 'time', 'activation_code', 'active', 'banned') VALUES(:uid, :user, :fname, :lname,:gender, :dob, :login, :password,:'ip,:device, :date,:'time, :activation_code,:active, :banned)"; ​$stmt -> bindParam(':uid',$uid); $stmt -> bindParam(':user',$user); ​$stmt -> bindParam(':fname',$fname); ​$stmt -> bindParam(':lname',$lname); etc etc. Followed by $stmt -> execute(); This is the best and safest way to interact with your database. It is also a lot easier to maintain and once you are used to it, understand. Good luck!
×
×
  • Create New...