Help with my php code

[senpai91]

---

^ dude!! it work!! thanks...

pwede nako mo padaun sa uban codes nako...

thanks a lot....unya rako mo gamit sa security purposes kung working na tanan...unya rapud ko mag encrypt sad..

[merinoabs]

ah cge bro,
gdluck.

[boang3000]

dalia ra taas sa thread. so ang problem ato ky ang form?

[-_-]

gi simplify lng nko bro.
nabantayn sd nko nga double checking n cya so ako nlng gipa mub.an

//Connect to database
$link = mysql_connect("localhost", "root", "") or die(mysql_error());
        mysql_select_db("user", $link) or die(mysql_error());

//Get post parameters from form        
$myusername=$_POST['user']; 
$mypassword=$_POST['pass'];

//Check database if username & password exist
$sql = ("SELECT * FROM USERS WHERE username='{$myusername}' and password='{$mypassword}'") or die(mysql_error());
$result = mysql_query($sql);


if(mysql_num_rows($result) > 0)
    header('Location:home.html');
else 
    echo"FAILED TO LOGIN!"; 

suwayi daw ni

[senpai91]

problem solved...

mag sugod nako encrypt karon ug secure sa mga forms

[boang3000]

aw maayo nun. unsa d i na imo gbuhat?

[senpai91]

db project proposal namo...puros rajud php ug sql ako gi gamit...

kay di baka hanas sa uban....practice2x lang pud ko...kay lingaw man sad...hahaha

[silent-kill]

security wise imong code pwede injectkan og SQL

[salbahis]

security wise imong code pwede injectkan og SQL

can be prevented if they use mysql_real_escape_string or mysql_escape_string (DEPRECEATED)

there are lot of possible solutions but this are the straight forward one... always use this if you have form that interact with your database or else ma inject-kan ang imo db...

[senpai91]

security wise imong code pwede injectkan og SQL

mao jud na akong gi buhat karon....ang ako lang is working cya...karon nag add naman ko mga security...
nag encrypt pud ko...