LAMP, a commonly used web development combination. Linux, Apache, MySql and PHP. Since, the language, PHP is designed for web developing, the language is very simple and anyone can learn it easily. And combining it with MySQL allows you to build very powerfull web sites.
There is one dangerous mistake that some people may do. Directly passing the values from the user to the database. How it could be so dangerous? I’ll show you an example.
Let’s say you have a login form and line like this in the action page.
$result=mysql_query(“SELECT * FROM users WHERE username=’”.$_POST['username'].”‘ AND pwd=’”.$_POST['password'].”‘”) ;
Normally, The script will add the values from the user into the sql query. So, It will be something like :
SELECT * FROM users WHERE username=’sandaruwan’ AND pwd=’secret’
There is nothing wrong with it. But let’s say, Instead of typing my username, if i type something like :
sandaruwan’#
What would happen? The script will insert this statement into the query. So, It will be something like :
SELECT * FROM users WHERE username=’sandaruwan’#’ AND pwd=’secret’
The symbol # means, comment out the rest of the query. In that case, the final query is like :
SELECT * FROM users WHERE username=’sandaruwan’
So, no matter what is the password, The script will allow you to login. Very simple!!! but effective.
