erro_sennin
Fun Poster
- Messages
- 796
- Joined
- May 10, 2010
- Messages
- 796
- Reaction score
- 41
- Points
- 20
yang bold kt atas, nk filter kena sebelum sql query, ne dh query nk filter bt apa g, benda dh terlepas.ha mcm mane ea??
lagi satu nak tnye,kalau kite da define kat databse tu sebagai user n admin,bile login tu berjaye,dye akan panggil page ape??
contoh :
<?php
$mysql_server = "localhost";
$mysql_user = "root";
$mysql_password = "";
$mysql_database = "sistem_aduan_kerosakan_ict";
$conn = mysql_connect($mysql_server, $mysql_user, $mysql_password);
mysql_select_db($mysql_database, $conn);
// username and password sent from form
$myusername=$_POST['username'];
$mypassword=$_POST['password'];
$sql="SELECT * FROM pengguna WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
// If result matched $myusername and $mypassword, table row must be 1 row
if($result){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_start();
$_SESSION['username'] = $myusername;
$_SESSION['password'] = $mypassword;
}
if(mysql_num_rows($result) > 0){
echo("<SCRIPT language='javascript'>
window.alert('Katalaluan betul');
window.location='../pentadbir.php';
</SCRIPT>");
exit;
}else {
echo("<SCRIPT language='javascript'>
window.alert('Katalaluan salah');
window.location='../index.php';
</SCRIPT>");
exit;
}
?>
diibaratkan dh terlepas baru nk pkai kondom..tak guna dh.
tukar filter code sebelum query
PHP:
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM pengguna WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
