BTC USD 86,279.2 Gold USD 4,362.29
Time now: Jun 1, 12:00 AM

problem with php

ha mcm mane ea??
lagi satu nak tnye,kalau kite da define kat databse tu sebagai user n admin,bile login tu berjaye,dye akan panggil page ape??
contoh :
<?php

$mysql_server = "localhost";
$mysql_user = "root";
$mysql_password = "";
$mysql_database = "sistem_aduan_kerosakan_ict";

$conn = mysql_connect($mysql_server, $mysql_user, $mysql_password);

mysql_select_db($mysql_database, $conn);


// username and password sent from form
$myusername=$_POST['username'];
$mypassword=$_POST['password'];

$sql="SELECT * FROM pengguna WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);


// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);



// If result matched $myusername and $mypassword, table row must be 1 row
if($result){

// Register $myusername, $mypassword and redirect to file "login_success.php"
session_start();
$_SESSION['username'] = $myusername;
$_SESSION['password'] = $mypassword;
}
if(mysql_num_rows($result) > 0){
echo("<SCRIPT language='javascript'>
window.alert('Katalaluan betul');
window.location='../pentadbir.php';
</SCRIPT>");
exit;
}else {
echo("<SCRIPT language='javascript'>
window.alert('Katalaluan salah');
window.location='../index.php';
</SCRIPT>");
exit;
}
?>
yang bold kt atas, nk filter kena sebelum sql query, ne dh query nk filter bt apa g, benda dh terlepas.

diibaratkan dh terlepas baru nk pkai kondom..tak guna dh.

tukar filter code sebelum query

PHP:
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM pengguna WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
 
Back
Top
Log in Register