My PHP Video Tutorials - Page 2

Spit-wad · 03-09-2009, 02:27 PM

well since I don't know the syntax, the actual code was a bit over my head cuz you went pretty fast... but I can just go back and pause to look at it, so that's not a problem

basically had more trouble understanding the general setup of the whole thing... i think i just need to read up a bit, np

vernong1992 · 03-09-2009, 03:08 PM

I subscribed to this.. I need this

kmote · 03-09-2009, 07:03 PM

Good tutorials there but it looks like login.php is vulnerable to SQL injection.

CrazeD · 03-09-2009, 10:32 PM

Quote:

Originally Posted by kmote

Good tutorials there but it looks like login.php is vulnerable to SQL injection.

As it is only a basic tutorial, I didn't do much with security. However, mysql_escape_strings will pretty much eliminate SQL injection, by escaping any illegal characters. If you wanted to take it a bit further, you could use some regex to custom filter the data before you do any queries.

kmote · 03-10-2009, 09:07 AM

I just checked again and actually I now think you are safe with what you have. I should think then type lol.

Spit-wad · 03-10-2009, 06:26 PM

Do you have to pay for the MySQL stuff?

kmote · 03-10-2009, 06:56 PM

Nope, nor do you have to pay for apache or PHP.

Spit-wad · 03-10-2009, 07:20 PM

what do I need to download? I found some things that said 30-day trial, which made me ask that question.

office politics · 03-10-2009, 10:08 PM

Quote:

Originally Posted by CrazeD

As it is only a basic tutorial, I didn't do much with security. However, mysql_escape_strings will pretty much eliminate SQL injection, by escaping any illegal characters. If you wanted to take it a bit further, you could use some regex to custom filter the data before you do any queries.

i did a quick search and found the following thread. The posters say mysql_real_escape_strings is more secure.

I'm wondering if it would be possible to run subqueries. i think you need parathenses.

PHP Code - Help Needed - Dev Shed

edit - here's a read for ya

Reviewing Code for SQL Injection - OWASP

CrazeD · 03-10-2009, 10:25 PM

Quote:

Originally Posted by Spit-wad

what do I need to download? I found some things that said 30-day trial, which made me ask that question.

A Guide to Installing Apache, PHP, MySQL, and PHPMyAdmin on Windows

Here you go.

@ office_politics:

mysql_real_escape_string doesn't make a difference for the standard latin1 character set. Its only difference is that it escapes for more character sets.

Also, by subqueries, do you mean multiple queries? You need to use PHP's mysqli for that.

Member Login