echo out first_name from the database after using the command above but it's not working.
How should the code be?
It is not safe, use PDO. First see a tutorial Pdo, it's sample. After: https://stackoverflow.com/questions/51240891/select-sql-row-using-pdo-with-where-statement
My email is lol; drop table users;
What do you mean
Your line of code is vulnerable to an attack commonly known as 'SQL injection'. Well, unless you escape $email behind the screen. You ask a user to type in email, he types lol; drop table users; It turns into SELECT * FROM users WHERE email='lol; drop table users; '"); SQL sees it as 3 different lines. 1st and 3rd would give errors, second will drop the table called users :D
I have done email validation with JavaScript
That's better, but it's still not secure enough. If it's a post form, someone can use a tool like insomnia to send a post request directly =)
How can I solve it then
Yes, validate it on server as @Silas_229 said.
Never Trust The User, the front end validation is only mean to improve the user experience.
Could validation using JavaScript and mysqli_real_escape_string project my website from SQL injection?
Use prepare statement
I can remove js validation easily😂
Always do server side validation , front end can be easily change
U need to use filters too
Never Trust The User
Even Tester too
🤔. How is that possible
Play with browsers developers option
Easiest option will be to remove class/id frm the input which you want yo bypass becuase most of JS validation are given through class/id only.. Another could be to look at the xhr request and send same request from Postman (if target is not using csrf)
I don't trust client side form validation because can be by passed easily, it is better to use both.
Even editing the codes and modifying it.
Hello @Jeegar26 . I changed the authentication system to the server side. I used mysqli_real_escape string and prepared statements.
I have now done the backend form validation and also worked on countering SQL injection.
Thanks
👍😁
Обсуждают сегодня