sql injection help

[landi]

Hi,
Change:

Code: Select all

$username = $_REQUEST['username'];
$password = $_REQUEST['password'];

to escape the values like this:

Code: Select all

$username = mysql_real_escape_string($_REQUEST['username']);
$password = mysql_real_escape_string($_REQUEST['password']);

Checkout: http://php.net/manual/en/function.mysql ... string.php for more info. Note that the mysql_ functions are now end of life.

-A