[Truth3356]

I need help fixing "unexpected '='" , i'm going insane figuring it out, i know it has to do with characters in a variable name, but i still cant figure out what the issue is here :

PHP Code


<?php 
$loginsql = "SELECT * FROM logins WHERE username" = "'$_POST;['userBox']. ";' && password = "' . sha1($_POST['passBox']) . "'"; 


[l0lwtf]

Try the following:



WARNING: this code is insecure. It is vulnerable to SQL injection.

[PleaseSir]

Please use code tags so we can make better sense of the code op.

[Truth3356]

Try the following:



WARNING: this code is insecure. It is vulnerable to SQL injection.

Thank you sir.

[Xerotic]

Thank you sir.

Be aware of what the member posted. The code you supplied is vulnerable to SQL injection and would allow your database to be dumped, deleted, etc.

[Truth3356]

Be aware of what the member posted. The code you supplied is vulnerable to SQL injection and would allow your database to be dumped, deleted, etc.

Totally, i did take notice of it, i don't have plans of making this public anytime soon, so i will get it fixed prior to doing that.

[Xerotic]

Totally, i did take notice of it, i don't have plans of making this public anytime soon, so i will get it fixed prior to doing that.

I highly suggest to consider PDO (prepared statements). https://www.php.net/manual/en/book.pdo.php

They are the best standard right now and will help keep your code safer.

[Pinhead Larry]

The login looks really sloppy, prone to injections. You have no sort of filter for userBox.

As Xerotic said, look into prepared statements. MySQLI even has procedural statements if OOP is a bit much.

$userBox = $_POST['userBox'];
$password = sha1($_POST['passBox']);
$loginsql = "SELECT * FROM `logins` WHERE `username` = '{$userBox}' AND `password` = '{$password}'"

^
Above will work and looks more readable

[Kallu609]

...

Holy shit Xerotic is still in the game 😁
I remember seeing you active in the Python section years ago. You've taught me a few things too, thanks for that!

The login looks really sloppy, prone to injections. You have no sort of filter for userBox.

As Xerotic said, look into prepared statements. MySQLI even has procedural statements if OOP is a bit much.

$userBox = $_POST['userBox'];
$password = sha1($_POST['passBox']);
$loginsql = "SELECT * FROM `logins` WHERE `username` = '{$userBox}' AND `password` = '{$password}'"

^
Above will work and looks more readable

No that's not how MySQLi, PDO or preventing SQLi attacks work. That's just string formatting (no escaping of characters, very BAD). To answer OP's question, this is what you have to do with PDO:



You can also use "?"s as placeholders, more info here: PHP: Prepared statements and stored procedures - Manual

[Truth3356]

Holy shit Xerotic is still in the game  😁
I remember seeing you active in the Python section years ago. You've taught me a few things too, thanks for that!


No that's not how MySQLi, PDO or preventing SQLi attacks work. That's just string formatting (no escaping of characters, very BAD). To answer OP's question, this is what you have to do with PDO:



You can also use "?"s as placeholders, more info here: PHP: Prepared statements and stored procedures - Manual

Ive been fixing it with parameterized statements.