+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] Unexpected '=' (/showthread.php?tid=5985780)
Unexpected '=' - Truth3356 - Jul 2, 2019
I need help fixing "unexpected '='" , i'm going insane figuring it out, i know it has to do with characters in a variable name, but i still cant figure out what the issue is here :
PHP Code
<?php
$loginsql = "SELECT * FROM logins WHERE username" = "'$_POST;['userBox']. ";' && password = "' . sha1($_POST['passBox']) . "'";
RE: Unexpected '=' - l0lwtf - Jul 2, 2019
Try the following:
WARNING: this code is insecure. It is vulnerable to SQL injection.
RE: Unexpected '=' - PleaseSir - Jul 2, 2019
Please use code tags so we can make better sense of the code op.
RE: Unexpected '=' - Truth3356 - Jul 2, 2019
(Jul 2, 2019 09:18 AM)l0lwtf Wrote: Try the following:
WARNING: this code is insecure. It is vulnerable to SQL injection.
Thank you sir.
RE: Unexpected '=' - Xerotic - Jul 2, 2019
(Jul 2, 2019 09:36 AM)Truth3356 Wrote: Thank you sir.
Be aware of what the member posted. The code you supplied is vulnerable to SQL injection and would allow your database to be dumped, deleted, etc.
RE: Unexpected '=' - Truth3356 - Jul 2, 2019
(Jul 2, 2019 12:53 PM)Xerotic Wrote: Be aware of what the member posted. The code you supplied is vulnerable to SQL injection and would allow your database to be dumped, deleted, etc.
Totally, i did take notice of it, i don't have plans of making this public anytime soon, so i will get it fixed prior to doing that.
RE: Unexpected '=' - Xerotic - Jul 2, 2019
(Jul 2, 2019 01:10 PM)Truth3356 Wrote: Totally, i did take notice of it, i don't have plans of making this public anytime soon, so i will get it fixed prior to doing that.
I highly suggest to consider PDO (prepared statements). https://www.php.net/manual/en/book.pdo.php
They are the best standard right now and will help keep your code safer.
RE: Unexpected '=' - Pinhead Larry - Jul 2, 2019
The login looks really sloppy, prone to injections. You have no sort of filter for userBox.
As Xerotic said, look into prepared statements. MySQLI even has procedural statements if OOP is a bit much.
$userBox = $_POST['userBox'];
$password = sha1($_POST['passBox']);
$loginsql = "SELECT * FROM `logins` WHERE `username` = '{$userBox}' AND `password` = '{$password}'"
^
Above will work and looks more readable
RE: Unexpected '=' - Kallu609 - Jul 4, 2019
(Jul 2, 2019 12:53 PM)Xerotic Wrote: ...
Holy shit Xerotic is still in the game 😁
I remember seeing you active in the Python section years ago. You've taught me a few things too, thanks for that!
(Jul 2, 2019 03:51 PM)Pinhead Larry Wrote: The login looks really sloppy, prone to injections. You have no sort of filter for userBox.
As Xerotic said, look into prepared statements. MySQLI even has procedural statements if OOP is a bit much.
$userBox = $_POST['userBox'];
$password = sha1($_POST['passBox']);
$loginsql = "SELECT * FROM `logins` WHERE `username` = '{$userBox}' AND `password` = '{$password}'"
^
Above will work and looks more readable
No that's not how MySQLi, PDO or preventing SQLi attacks work. That's just string formatting (no escaping of characters, very BAD). To answer OP's question, this is what you have to do with PDO:
You can also use "?"s as placeholders, more info here: PHP: Prepared statements and stored procedures - Manual
RE: Unexpected '=' - Truth3356 - Jul 4, 2019
(Jul 4, 2019 12:19 AM)Kallu609 Wrote: Holy shit Xerotic is still in the game 😁
I remember seeing you active in the Python section years ago. You've taught me a few things too, thanks for that!
No that's not how MySQLi, PDO or preventing SQLi attacks work. That's just string formatting (no escaping of characters, very BAD). To answer OP's question, this is what you have to do with PDO:
You can also use "?"s as placeholders, more info here: PHP: Prepared statements and stored procedures - Manual
Ive been fixing it with parameterized statements.