29.09.2012, 22:53
I'm glad you fixed the issue.
What I meant by vulnerable to SQL injections is this textbook example when a player inserts a single quote (') as their password, the query will look like:
SELECT * FROM players WHERE name = 'Andre' and pass = '''
(3 single quotes in the end).
This will just break the query, but think what would happen if the user entered "lol'; DROP TABLE players;" as their password. Poof, whole table with all infos = gone.
Use mysql_real_escape_string to avoid it (or try using mysql_format, see if you can without crashing).
Also, 100 posts.
What I meant by vulnerable to SQL injections is this textbook example when a player inserts a single quote (') as their password, the query will look like:
SELECT * FROM players WHERE name = 'Andre' and pass = '''
(3 single quotes in the end).
This will just break the query, but think what would happen if the user entered "lol'; DROP TABLE players;" as their password. Poof, whole table with all infos = gone.
Use mysql_real_escape_string to avoid it (or try using mysql_format, see if you can without crashing).
Also, 100 posts.