Quick MySQLi security question
- by Benjamin Falk
I have a quick MySQLi security related question...
For example, take a look at this code (gets in put from the user, checks it against the database to see if the username/password combination exist):
$input['user'] = htmlentities($_POST['username'], ENT_QUOTES);
$input['pass'] = htmlentities($_POST['password'], ENT_QUOTES);
// query db
if ($stmt = $mysqli->prepare("SELECT * FROM members WHERE username=? AND password = ?"))
{
$stmt->bind_param("ss", $input['user'], md5($input['pass'] . $config['salt']));
$stmt->execute();
$stmt->store_result();
// check if there is a match in the database for the user/password combination
if ($stmt->num_rows > 0)
{}
}
In this case, I am using htmlentities() on the form data, and using a MySQLi prepared statement. Do I still need to be using mysql_real_escape_string()?
