[thispc]

Hello, @thisps , i have to tell you that by this example and this type of threads you are actually attracting geeks to use this kind of knowledge for malicious purposes and possibly buy trouble for themselves which we are not in favor.

for general fact SQL Injections as fairly negligible at current point of technology, specially with the use of prepared statements . i would rather appreciate you talking about the security enhancement    

for above illustration and most other attacks all you need to do is pass query through a escaping function like mysql_real_escape_string() in PHP and best is to use PDO/Prepared Statements

Best Regards

Sir, i totally get it...I just want this thread to be precautionary measure, if any one uses php to connect to a database.
And as you say, this basic example which i provided can be avoided through mysql_real_escape_string() function.
But there are other dozens of security vulnerabilities in  sql/php that can be help to everyone for "security enhancements"..
For example even if we use this escape function, Like %% or _ can be used to guess password length or characters inside it, "if used carelessly".

---

PDO!!

You should use it like this:

PHP Code: (Select All)

<?php
$dsn = 'mysql:dbname=testdb;host=127.0.0.1';
$user = 'dbuser';
$password = 'dbpass';

try {
    $dbh = new PDO($dsn, $user, $password);
} catch (PDOException $e) {
    echo 'Connection failed: ' . $e->getMessage();
}

try {
    $query = $db->prepare("SELECT * FROM users WHERE username=:user AND password=:password");
    $query->execute(['user' => $username, 'password' => $password]);
    if($query->rowCount() > 0) {
        echo 'Welcome!!';
    } else {
        echo 'There is no row with the given credentials.';
    }
} catch(PDOException $e) {
    echo 'Database error: ' . $e->getMessage();
} 


Although it should work, I have not tested it.

Colon acts as bind variable, although i don't understand how it will work