Re: Fwd: Query results

Поиск
Список
Период
Сортировка
От Joel Burton
Тема Re: Fwd: Query results
Дата
Msg-id JGEPJNMCKODMDHGOBKDNKEOCCFAA.joel@joelburton.com
обсуждение исходный текст
Ответ на Fwd: Query results  (Trevor Morrison <trevor@hailix.com>)
Список pgsql-novice
Дерево обсуждения 

> I am trying to setup a simple databaes authoriztion of users using
> Postgresql 7.2 and PHP 4.1.  I have
> included the code below:
>

> <body>
> <?php
> switch($do) {
>
>     case "authenticate":
>
>     $Host = "localhost";
>     $User = "trevor";
>     $Password = "";
>     $DBName = "users";
>     $TableName="users";
>
>     $Link = pg_connect("host=$Host dbname=$DBName user=$User")
> or die ("Couldn't
> connect to the database");
>
>     $Query = "SELECT  id from $TableName where username='$username' and
> password='$password'";
>
>     $results = pg_exec($Link, $Query) or die ("Couldn't connect to the
> database");
>
>     $num = pg_numrows($results) or die ("Couldn't count rows");
>
>     if ($num == 1) {
>
>     echo "<P>You are a valid user!<BR>";
>     echo "Your user name is $username<BR>";
>     echo "Your user password is $password</P>";
>
>     }
>         else if ($num == 0){
>             unset ($do);
>             echo "<P>You are not authorized! Please try
> again.</p>";
>             include("login_form.inc");
>     }
>     break;
>
>     default:
>     include("login_form.inc");
> }
>
> ?>
> </body>
>
> This script works great as long as the name is in the database,
> but if it is
> not then $num has no value and conseqently errors out.  Even if
> you use the
> correct firstname and and an incorrect password the pg_numrows errors out.
>
> Any help would be appreciated.

How about:
  if ($num >= 1) { valid }
  else { invalid }

BTW, be careful with code like this. What will happen when someone enters a
username like "bob'; delete from important_table; select * from users where
username='bob".

PHP may see this as a select query, a delete query, and a select query. Make
sure your permissions in the database are tight, and consider using safe
quoting functions in PHP.

Joel

В списке pgsql-novice по дате отправления: