$Result = $connection->query("SELECT * FROM users WHERE email='$email'"); I'm trying to

Your line of code is vulnerable to an attack commonly known as 'SQL injection'. Well, unless you escape $email behind the screen. You ask a user to type in email, he types lol; drop table users; It turns into SELECT * FROM users WHERE email='lol; drop table users; '"); SQL sees it as 3 different lines. 1st and 3rd would give errors, second will drop the table called users :D

0

12.02.2021

Пользователь 63429 Автор вопроса

Alignant
Your line of code is vulnerable to an attack commo...

I have done email validation with JavaScript

0

12.02.2021

Пользователь 63429 Автор вопроса

Alignant
Your line of code is vulnerable to an attack commo...

0

12.02.2021

Alignant

Пользователь 63429
I have done email validation with JavaScript

That's better, but it's still not secure enough. If it's a post form, someone can use a tool like insomnia to send a post request directly =)

0

12.02.2021

Пользователь 63429 Автор вопроса

Alignant
That's better, but it's still not secure enough. I...

How can I solve it then

0

12.02.2021

Alignant

Пользователь 63429
How can I solve it then

Yes, validate it on server as @Silas_229 said.

0

12.02.2021

Reny Ramos

Пользователь 63429

Never Trust The User, the front end validation is only mean to improve the user experience.

0

12.02.2021

Пользователь 63429 Автор вопроса

Alignant
Your line of code is vulnerable to an attack commo...

Could validation using JavaScript and mysqli_real_escape_string project my website from SQL injection?

0

05.03.2021

Rajesh

Пользователь 63429

Could validation using JavaScript and mysqli_real_...

Use prepare statement

0

05.03.2021

Jeegar

Пользователь 63429

Could validation using JavaScript and mysqli_real_...

I can remove js validation easily😂

0

05.03.2021

Jeegar

Пользователь 63429

Could validation using JavaScript and mysqli_real_...

Always do server side validation , front end can be easily change

0

05.03.2021

Rajesh

Jeegar
I can remove js validation easily😂

Yes

0

05.03.2021

Jeegar

Пользователь 63429

Could validation using JavaScript and mysqli_real_...

U need to use filters too

0

05.03.2021

SoHeil

Jeegar
Always do server side validation , front end can ...

+

0

05.03.2021

Reny Ramos

Пользователь 63429

Could validation using JavaScript and mysqli_real_...

Never Trust The User

0

05.03.2021

Jeegar

Reny Ramos
Never Trust The User

Even Tester too

0

05.03.2021

Пользователь 63429 Автор вопроса

Jeegar
I can remove js validation easily😂

🤔. How is that possible

0

05.03.2021

Jeegar

Пользователь 63429
🤔. How is that possible

Play with browsers developers option

0

06.03.2021

M M

Пользователь 63429
🤔. How is that possible

Easiest option will be to remove class/id frm the input which you want yo bypass becuase most of JS validation are given through class/id only.. Another could be to look at the xhr request and send same request from Postman (if target is not using csrf)

0

06.03.2021

Generation Z Aloyce Daniel

Пользователь 63429

Could validation using JavaScript and mysqli_real_...

I don't trust client side form validation because can be by passed easily, it is better to use both.

0

07.03.2021

Generation Z Aloyce Daniel

Jeegar
Even Tester too

😂😂😂😂😂😂😂

0

07.03.2021

Generation Z Aloyce Daniel

M M
Easiest option will be to remove class/id frm the ...

Even editing the codes and modifying it.

0

07.03.2021

Пользователь 63429 Автор вопроса

Rajesh
Use prepare statement

Hello @Jeegar26 . I changed the authentication system to the server side. I used mysqli_real_escape string and prepared statements.

0

17.03.2021

Пользователь 63429 Автор вопроса

Jeegar
Always do server side validation , front end can ...

I have now done the backend form validation and also worked on countering SQL injection.

0

17.03.2021

Jeegar

Пользователь 63429
Hello @Jeegar26 . I changed the authentication sys...

👍

0

18.03.2021

Dern

Пользователь 63429

I have now done the backend form validation and al...

😍

0

18.03.2021

Rajesh

Пользователь 63429
Hello @Jeegar26 . I changed the authentication sys...

👍

0

18.03.2021

Пользователь 63429 Автор вопроса

Jeegar
👍

Thanks

0

18.03.2021

Пользователь 63429 Автор вопроса

Dern
😍

👍😁

0

18.03.2021

Пользователь 61a87 · Accepted Answer

Пользователь 61a87

It is not safe, use PDO. First see a tutorial Pdo, it's sample. After: https://stackoverflow.com/questions/51240891/select-sql-row-using-pdo-with-where-statement

0

12.02.2021

Похожие чаты

$Result = $connection->query("SELECT * FROM users WHERE email='$email'"); I'm trying to

32 ответов

Похожие вопросы