[Kristoffer G]

[/QUOTE]

Originally posted by gsoc@Mar 11 2008, 23:13
Vet inte om det bara är jag men det ser ut som din applikation är väldigt sårbar för sql injections...

register.php

$in_user

Login.php

$in_user

Sen kan man nog ta $var1 i funktionen exists, men det blir ungefär samma bara det att det är på databas anslutningar man kommer åt...

Använder PDO med prepared statements på alal databaskopplingar. Anses vara det säkraste idag. Innan jobbade man mycket med mysql_real_escape_string(), addslashes() osv...

Som jag skrev i edit så har jag glömt uppdatera SQL inputen till prepared.

Man kan sen utköka de script jag skickade med mer säkerhet... men det va inte det som diskutterades här.

Läs mer här (php.net)

Prepared statements and stored procedures
Many of the more mature databases support the concept of prepared statements. What are they? You can think of them as a kind of compiled template for the SQL that you want to run, that can be customized using variable parameters. Prepared statements offer two major benefits:

The query only needs to be parsed (or prepared) once, but can be executed multiple times with the same or different parameters. When the query is prepared, the database will analyze, compile and optimize it's plan for executing the query. For complex queries this process can take up enough time that it will noticeably slow down your application if you need to repeat the same query many times with different parameters. By using a prepared statement you avoid repeating the analyze/compile/optimize cycle. In short, prepared statements use fewer resources and thus run faster.
The parameters to prepared statements don't need to be quoted; the driver handles it for you. If your application exclusively uses prepared statements, you can be sure that no SQL injection will occur. (However, if you're still building up other parts of the query based on untrusted input, you're still at risk).
Prepared statements are so useful that they are the only feature that PDO will emulate for drivers that don't support them. This ensures that you will be able to use the same data access paradigm regardless of the capabilities of the database.