Hi..
I had written this code to prevent sql injection in the login form (i use oracle 10g)
$query = "SELECT USER_NAME, PASSWORD, GROUP_ID,user_id ,f_login_status
FROM ADSL_USERS
WHERE active <> 0
AND USER_NAME =:user AND PASSWORD = :pass ";
$stid = oci_parse($conn, $query);
oci_bind_by_name($stid, ':user', $_POST['username']);
oci_bind_by_name($stid, ':pass', md5($_POST['password']));
oci_execute($stid);
$row = oci_fetch_array($stid, OCI_RETURN_NULLS);
it deos not return any value
i hade this before but it was exposed to sql injection
$query = "SELECT USER_NAME, PASSWORD, GROUP_ID,user_id ,f_login_status
FROM ADSL_USERS
WHERE active <> 0
AND USER_NAME ='".$_POST['username']."' AND PASSWORD = '".md5($_POST['password'])."'";
