22.08.2017, 22:45
Holy Crap,
Your script is completely open to MySQL Injection.
Please use prepared statements.
PHP Prepared Statements
Your script is completely open to MySQL Injection.
Code:
$query = "SELECT Username, Password FROM `Users` WHERE `Username` = '".$_POST["playerName"]."'"; $result = mysqli_query($conn, $query);
Code:
$stmt = $mysqli->prepare("SELECT Username, Password FROM `Users` WHERE `Username` = :username "); $stmt->execute( array( ":username", $_POST[ 'playerName' ] ) );