4 ms·
Indeed. Of course all the sane defaults in the world won't stop someone copying and pasting shit like this from a dodgy tutorial: $password = mysql_query("
by FuzzyDunlop 14y ago
Indeed. Of course all the sane defaults in the world won't stop someone copying and pasting shit like this from a dodgy tutorial:
$password = mysql_query("SELECT password FROM users
WHERE email = ".$_POST['email']." LIMIT 1");
To clarify this to the downvoters who chose not to comment:
The finest password hashing algorithm ever committed to source control won't protect your other sensitive information (address, phone numbers, etc.) when SQL injection can make your entire database vulnerable to attack.
- Kudos 14y agoYes, but there's a greater chance that basic tutorials that for example use unsalted sha1 will use this method instead. It's just as simple for a beginner to grok, but secure by default.
- ErrantX 14y agoThe code he posted has different vulnerability; i.e. SQL injection. Your password could be ultra-secure, but it doesn't matter if you use that code without sanitizing inputs :) I guess the reason he is being downvoted is; badly hashed passwords are not merely a newbie problem...
- Kudos 14y agoSQLi a different though related issue so I reframed it with an example that this solves.