Hacking Websites with SQL Injection - Computerphile

What people said

Recommends p.s.w.g · 2014-01 · Stack Overflow · on “How to insert bool into database”

For more information, watch Hacking Websites with SQL Injection [this video] and How NOT to Store Passwords! [LINK] for an introductory discussion of these problems.

Recommends Bartheleway · 2014-04 · Stack Overflow · on “Error in login form when try to log in”

So first of all, you should really watch this video [this video] and then use prepared statements instead of that old fashioned syntax. To produce even better code, you should think about using PDO instead of mysql function because it will allow you to change your database engine in one line of code. Then, you should use the object syntax a lot more. Everything should be encapsulated in objects and you should only have one entry point which will be your application. After all these changes, it should just work because you will not have that quote problem that Jenz was talking about. To specifically answer your question, can you do a print_r($row) and give us the result ?

Recommends Jeremiah Smith · 2016-06 · Stack Overflow · on “Creating login page with php and mysql”

I'm afraid I don't yet have the rep to add this as simply a comment and must therefore leave it as an answer. You're code, as written, is vulnerable to an SQL injection attack. If you're not familiar with that there are some great videos on [this video] detailing what this means and how to protect your database. You must sanitize your code. Best of luck, Jeremiah

Recommends Piotr Kamoda · 2019-06 · Stack Overflow · on “I want to search by city and state by name and in which table i want to search that table insert city and state id”

Try this: $condition = "1=1"; if(!empty($state_id)) { $condition .=" and sangh_directory.state like '$state_id%'"; } if(!empty($city_id)) { $condition .=" and sangh_directory.city like '$city_id%'"; } if(!empty($searchsangh)) { $condition .=" and sangh_directory.sangh_name like '$searchsangh%'"; } $DirectoryDetailsQuery=$con->select_query("sangh_directory","*","inner join city on city.city_id=sangh_directory.city inner join country ON country.country_id=sangh_directory.country inner join state ON state.state_id=sangh_directory.state where $condition"); I'm sorry if this is not syntactically correct, I hope you're getting the gist of it. And if you are making a website that will be public, pl

Cites Theraot · 2013-11 · Stack Overflow · on “How to solve parameters in MYSQLi?”

The initial problem You have to pass the connection object to the function mysqli_error , like this: $result = mysqli_query($link, $strQuery) or die(mysqli_error($link)); And this... $result2 = mysqli_query($link, $strQuery) or die(mysqli_error($link)); Note: your code must have another problem that will be revealed after you do this. PHP wouldn't be executing the part of mysqli_error if there weren't an error in the query or something related to it. The hidden problem In fact, I have reasons to think* the problem is that $ors['profile'] is string, and therefore it should be between quotation marks in the query string: $strQuery = 'select sum(MT) as totalLM from tbljocreator where PROFILE =

Cites Jozef Legény · 2014-01 · Stack Overflow · on “PHP update multiple rows with multiple WHERES doenst work”

You can not update multiple fields like that. Look at answers in this question SQL Statement with multiple SET's and WHERE's [LINK] Also do not forget to sanitize your input, taking values directly from $_POST and putting them into a query is asking for a SQL Injection [this video] .

Cites gen_Eric · 2014-04 · Stack Overflow · on “mysql_escape_string(), error on long string, any alternative?”

[this video] This video talks about the difference between `mysql_escape_string` and `mysql_real_escape_string` ( [this video] ).

Cites CerebralFart · 2015-04 · Stack Overflow · on “Pass select query from the client side”

Unless you're building something that is explicitly for executing queries on a database (PHPMyAdmin, or such), it is NEVER okay to do this. Why? A malicious user can now delete your ENTIRE database, simply by editing the javascript. $.ajax({ url: "", type: "post", data: {query: "DROP database"}, success: }) The best practice is to send the data to the server, and construct your query over there. The only attack that is left is SQL-injection. Solutions for this are specific to each language, but you can have a look at Tom Scott's explanation on it [this video] .

Cites Kamil Latosinski · 2017-03 · Stack Overflow · on “PHP and jQuery insert into MySQL”

You have 3 problems. Problem number one and two are related. Firstly, you are specifying dataType: 'json' , but you are passing your data in application/x-www-form-urlencoded format. Secondly, your php script expects data to be in the following format: $_POST = [ 'Text' => ['text_1', 'text_2', 'text_3'], 'Amount' => ['amount_1', 'amount_2', 'amount_3'] ]; While your data looks something like this: $_POST = [ 'Text_1' => 'text_1', 'Text_2' => 'text_2' // and so on ]; The single fix to this problem is as follows: $(document).ready(function() { $("#submit").click(function() { const data = { // we are grabbing all inputs with name=Text[] // and mapping them to array containing their values. // T

Cites Gaurav Mall · 2019-07 · Stack Overflow · on “Is there a better way to combat SQL Injection?”

I've watched Computerphile's video many times on this subject(for any of you who want, this is the link: [this video] ). He provides some really good advice on how to combat SQL Injection and make your app more effective. These are the key points from his video: Don't use straight and unprotected SQL commands because this is the way hackers can perform a SQL Injection, stealing, modifying, or even deleting your data. A good approach is to use the mysql_real_escape_string(String s) function. This basically places on the start of every dangerous character ( /,", {, }, etc ) a slash ( / ). So basically this makes the quote or slash inside the string useless. The best thing to do is to use prepared s