3 ms·
If someone can execute a "SELECT * FROM user" query, it's highly likely that they can also intercept login form responses to retrieve plain text passwords.
by dhx 15y ago
If someone can execute a "SELECT * FROM user" query, it's highly likely that they can also intercept login form responses to retrieve plain text passwords.
- jrockway 15y agoNot true in practice. The select statement is often tacked on to some other database query. To intercept login form responses would require the ability to run "real code" rather than just ask the database things. The reality is that most programmers do not call eval("code from the user") but they often call sql_query("code from the user").