Have Geek Brain

Need help with some SQL

<?php

if (isset($_POST['email'])) {

$email = mysql_real_escape_string($_POST['email']);
$password = mysql_real_escape_string($_POST['password']);

mysql_query("INSERT INTO accounts (email, password) VALUES ('$email', '$password')");

}

?>


<h1>Create Account</h1>

<form action="" method="post">
<table cellspacing="3">

<tr>
 <td valign="top">E-mail address:</td>
 <td><input type="text" name="email" size="28"></td>
</tr>

<tr>
 <td valign="top">Password:</td>
 <td><input type="text" name="password" size="28"></td>
</tr>

<tr>
<td colspan="2" align="center">
  <input type="submit" value="Submit">
</td>
</tr>

</table>
</form>

How can I prevent people from just typing spaces and inserting blank entries?: / And do you see any other potential threats?

Thanks. / Newbie

0


source to share


5 answers 


if(!empty($_POST['email']) && !empty($_POST['password'])){
  $email = trim($_POST['email']); // Remove trailing and leading spaces
  $password = trim($_POST['password']); 
  if( $email != "" && $password != ""){
    $email = mysql_real_escape_string($email);
    $password = mysql_real_escape_string($password);
    mysql_query("INSERT INTO accounts (email, password) VALUES ('$email', '$password')");
  } else {
    //DISPLAY ERROR MSG
  }
}


+2


source


You should do field validation before calling any SQL to prevent unwanted entries as well as SQL injection.

You can also impose some checks for the length / strength of the password, regex in the letter, etc.

In your code, now someone can type anything and anything.



Also, do you handle duplicate records on the DB side with a unique username / username constraint?

EDIT. It looks like you might have SQL Injection, already with mysql_real_escape_string

0


source


You can trim these values ​​and check for blank lines and then prompt the user for a real email address. You can also use a regular expression as part of some validation. Finally, I'm not sure how to achieve this with PHP, but you can parameterize the SQL.

0


source


You have to think about usability and security.

For ease of use: add javascript validators that will show some hints to users when users write emails in the wrong format, etc.

For security: you must validate the data before doing the insert-request, validators can be the same as js-validators (but smart users can just disable javascript in the browser)

0


source


as the schooner said, you have to check the fields before calling the sql query. I find it good practice to keep a file with common functions used to validate fields, so you can reuse those functions in your code. This check can be done using regular expressions. I left you an example.

function checkEmail($email) 
{
  if(preg_match("/^([a-zA-Z0-9])+([a-zA-Z0-9\._-])
               *@([a-zA-Z0-9_-])+([a-zA-Z0-9\._-]+)+$/",
               $email)){

    return true;
  }
  return false;
}

Also ... if you need to check the number of input records, you might be interested in finding an open greeter check library in php.

-1


source






More articles:


All Articles