Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Possible Problems:</p> <ol> <li>SQL Injection</li> <li>XSS Injection (if this code was an insert query, it would be a definite problem)</li> <li>Plain Text Password</li> </ol> <p>Your SQL Statement can be problematic. It is bad practice to leave yourself open for SQL injection.</p> <p><a href="http://en.wikipedia.org/wiki/SQL_injection" rel="nofollow noreferrer">SQL Injection is bad</a>. Trust me.</p> <p>If you want to display the $user on an HTML page, then you may not want to include the ability for people to "hack" your layout by typing in commands like </p> <pre><code>&lt;H1&gt;HI MOM&lt;/H1&gt; </code></pre> <p>or a bunch of <a href="http://en.wikipedia.org/wiki/Cross-site_scripting" rel="nofollow noreferrer">javascript</a>.</p> <p>Also, never store your password in plain text (good catch cagcowboy!). It gives too much power to people administering (or hacking) your database. You should never NEED to know someone's password.</p> <p>Try tactics like these:</p> <pre><code>// mostly pulled from http://snippets.dzone.com/posts/show/2738 function MakeSafe($unsafestring) { $unsafestring= htmlentities($unsafestring, ENT_QUOTES); if (get_magic_quotes_gpc()) { $unsafestring= stripslashes($unsafestring); } $unsafestring= mysql_real_escape_string(trim($unsafestring)); $unsafestring= strip_tags($unsafestring); $unsafestring= str_replace("\r\n", "", $unsafestring); return $unsafestring; } // Call a function to make sure the variables you are // pulling in are not able to inject sql into your // sql statement causing massive doom and destruction. $name = MakeSafe( $_POST["user"] ); $pwd = MakeSafe( $_POST["pwd"] ); // As suggested by cagcowboy: // You should NEVER store passwords decrypted. // Ever. // sha1 creates a hash of your password // pack helps to shrink your hash // base64_encode turns it into base64 $pwd = base64_encode(pack("H*",sha1($pwd))) </code></pre>
    singulars
    1. This table or related slice is empty.
    1. POHow dangerous is this PHP code?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USJeremiah
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POHow dangerous is this PHP code?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COSorry, but htmlentities() is just wrong. To 'undo' the magic_quotes_gpc-effect you have to use stripslashes() and still use mysql_real_escape_string() after that.
      singulars
      1. PO
      1. USPatrick Glandien
    2. COAlso only escape for html entities RIGHT before output. Dont escape and store it in the database.
      singulars
      1. PO
      1. USPatrick Glandien
    3. COReplacing mysql_escape_string with one appropriate to your database (or mysql_real_escape_string if you're paranoid like me and want the DB to escape it rather than PHP).
      singulars
      1. PO
      1. USPowerlord
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload