[Salorb]

Hey HF, I was wondering if someone could help me. I am currently working on a website for myself and I need a secure login page. Can anyone help? Thanks.

[B0$$]

are u looking for pro coder or a php coder ?

[Numinous]

To Secure the login page, you can add filters like
mysql_real_escape_string and stripslashes

[Salorb]

I mean I need a php coder who can code it from start to finish. Thanks

[Sir Asylum]

To Secure the login page, you can add filters like
mysql_real_escape_string and stripslashes

Dont give the newbies bad examples.
Tell them to use PDO or Mysql(i) instead.

[Numinous]

Dont give the newbies bad examples.
Tell them to use PDO or Mysql(i) instead.

Yea PDO is good but for a newbie , its better to start with mysql first then shift to MYSQLi or PDO

[Haxalot]

Yea PDO is good but for a newbie , its better to start with mysql first then shift to MYSQLi or PDO

It absolutely isn't. Why learn an obsolete API just to never use it again in a production environment? It's a waste of time, nor is it any easier. The MySQLi API exposes a procedural interface as well and it's more feature-rich.

---

Hey HF, I was wondering if someone could help me. I am currently working on a website for myself and I need a secure login page. Can anyone help? Thanks.

There are many people on here who can do this (including myself), but what are we going to get in return? You mentioned no form of payment (and had you, then this wouldn't have been the correct forum - the Market Place section would have).

[Mafugsa Bob]

To Secure the login page, you can add filters like
mysql_real_escape_string and stripslashes

Please do not ever post in this forum until you've educated yourself.

OP, never ever use mysql_* or stripslashes. Just use PDO.

[thegentlad22]

Please do not ever post in this forum until you've educated yourself.

OP, never ever use mysql_* or stripslashes. Just use PDO.

What's wrong with mysql ? why called the lad a uneducated person?

PDO = let others do the work for you the lazy way. using mysql = getting an education to what's the problem and why it's unsecured... which forces you to deal with the problem.

PDO has it's issues and there's are minor security holes can can result using it if you don't know how to filter inputs on your own.

However, OP just either learn how to use mysqli or PDO mysql itself is on it's dead bed.

I use 100% mysql but written my own functions to filter inputs and secure everything. I written my one monitoring system that tracts what each member is doing on my website. It compares their actions with my own defined patterns that detect a hacking attempt. I then lock them out once detected.

However, MYSQL is old you need to use MYSQLi which is the updated version and soon MYSQL will be obsolete. .

I did my own route because I knew PHP before it was common knowledge about SQL injections. Once it was common knowledge they took about 2 or 3 years to come up with mysqli and PDO. However, I was at the time writing my own website. I then had to find a quick solution. However, eventually since right now I am just doing finishing touches on my website. I will go back and rewrite my code using PDO.

I pick PDO because I am told it's universal with other database. I am using that just in case if I ever need to switch and use some other database for any reason.

[Quad]

What's wrong with mysql ? why called the lad a uneducated person?

PDO = let others do the work for you the lazy way. using mysql = getting an education to what's the problem and why it's unsecured... which forces you to deal with the problem.

PDO has it's issues and there's are minor security holes can can result using it if you don't know how to filter inputs on your own.

However, OP just either learn how to use mysqli or PDO mysql itself is on it's dead bed.

I use 100% mysql but written my own functions to filter inputs and secure everything. I written my one monitoring system that tracts what each member is doing on my website. It compares their actions with my own defined patterns that detect a hacking attempt. I then lock them out once detected.

However, MYSQL is old you need to use MYSQLi which is the updated version and soon MYSQL will be obsolete. .

I did my own route because I knew PHP before it was common knowledge about SQL injections. Once it was common knowledge they took about 2 or 3 years to come up with mysqli and PDO. However, I was at the time writing my own website. I then had to find a quick solution. However, eventually since right now I am just doing finishing touches on my website. I will go back and rewrite my code using PDO.

I pick PDO because I am told it's universal with other database. I am using that just in case if I ever need to switch and use some other database for any reason.

There's not that much to learn from the old MySQL API. Basically "If you stick unfiltered variables in a query, the query can be manipulated in unexpected ways". Use prepared statements instead, and it will make sure that nothing bad from the input enters the actual query.

$mysqli = new mysqli('localhost', 'root', '', 'mydatabase');
$stmt = $mysqli->prepare('INSERT INTO users (name, age) VALUES (?, ?)');
$stmt->bind_param('si', $_GET['name'], $_GET['age']);
$stmt->execute();

is more secure than

mysql_connect('localhost', 'root', '');
mysql_select_db('mydatabase');
mysql_query('INSERT INTO users (name, age) VALUES ('.$_GET['name'].', '.$_GET['age'].')');

Edit: Why did you go throgh the trouble to do all that when you could of just taken the simpler, faster and more secure route? ^^

[Mafugsa Bob]

What's wrong with mysql ? why called the lad a uneducated person?

PDO = let others do the work for you the lazy way. using mysql = getting an education to what's the problem and why it's unsecured... which forces you to deal with the problem.

PDO has it's issues and there's are minor security holes can can result using it if you don't know how to filter inputs on your own.

Nice paragraphs, n00b.
The MySQL API is deprecated and will be removed soon. I assume whoever I replied to didn't know that because he told OP to learn how to use the API AND THEN switch to something better. inb4 "TH3N H3 KN0WS HOW 2 DEEL WIT HOW UNSAEF IT IZ AND WILL NO H0W TO FITLER INPUT".

MySQL_ = old and deprecated. Teaches users to use built-in functions instead of querying (mysql_create_db). Teaches/forces users to filter input, which is often done badly which does more harm (removes special characters out of usernames and passwords) than good.
PDO = proper way to nullify any SQLi attempts based on education and empirical evidence. And it's object-oriented, so you can build on/over it with ease.

[thegentlad22]

There's not that much to learn from the old MySQL API. Basically "If you stick unfiltered variables in a query, the query can be manipulated in unexpected ways". Use prepared statements instead, and it will make sure that nothing bad from the input enters the actual query.

$mysqli = new mysqli('localhost', 'root', '', 'mydatabase');
$stmt = $mysqli->prepare('INSERT INTO users (name, age) VALUES (?, ?)');
$stmt->bind_param('si', $_GET['name'], $_GET['age']);
$stmt->execute();

is more secure than

mysql_connect('localhost', 'root', '');
mysql_select_db('mydatabase');
mysql_query('INSERT INTO users (name, age) VALUES ('.$_GET['name'].', '.$_GET['age'].')');

Ya I know but for me switching to PDO isn't because of the security holes. I never had any issues with my own solutions. The point is to filter all inputs. You need to restrict inputs to either numbers or a string that has no code. The more strict you're on your inputs the more secure it will be. However, the reason I am switching over is becasue PHP newer versions will drop support for MYSQL. it will solely used mysqli but I am told that they will ditch mysqli because it's not as good as PDO. I was told by 2020 they plan to ditch mysqli but it's not written in stone.

So, If I have to rewrite my code I would rather use whatever that will be standard for a long time. However, my point if you use MYSQL you can filter the inputs yourself and it gives you a good way to education yourself from the problems. That way if you in years from now decided to writer your own shit or write a programming language etc. You will learn from the teams PHP mistakes. I am saying to become a better programmer it's always good to learn others mistakes and how they overcome that problem. So, you never make those same mistakes in your life.

The main mistake in mysql was allowing SQL query code to run. People would directly insert the inputs to the query function. This resulted to execute sql code. which if a hacker knows his stuff can manipulate the query string and insert their own code. This is where they now tell you always filter your inputs because you can never trust people from the internet anymore.

Still I rather see OP learn the problems and issues and how PHP made the improvements rather then just tell him go use MYSQLI or PDO and never think about why we need it other then it's secure and it's about security. Then you will use these tools ignorantly because you never had the interest to learn.

I just think if your'e going to code or learn how to code you better learn it right and learn what common mistakes programmers make and try to eliminate those mistakes when you're coding. That was my attitude towards learning programming when i learned PHP and been using it for 6 years.

[Quad]

Sure you can filter inputs easily if you expect nothing but numbers or alphabetical strings, but what about a forum where people are supposed to be able to post code?

If you absolutely want to teach newbies about why we use prepared statements today, just tell them what can happen when you stick variables in a query string. There's no point in learning the old MySQL API.

"I just think if your'e going to code or learn how to code you better learn it right"
I couldn't have said better myself

[Mafugsa Bob]

It's better to teach newbies about the ways raw queries can be manipulated, and how people have tried to bypass it and how people have bypassed security. And how to make secure code (PDO).

[Knar.]

I thought we were done explaining why using PDO or MySqli over native mysql functions is better.

---

I just think if your'e going to code or learn how to code you better learn it right and learn what common mistakes programmers make and try to eliminate those mistakes when you're coding. That was my attitude towards learning programming when i learned PHP and been using it for 6 years.

Learning PDO and MySqli would be learning it right, why would you learn the old stuff when you can learn the new stuff? Sure he might learn why PDO is better over the old mysql api, but there is no need for that as he is just starting. All he needs are the basics.