Quote from: osmanadak on September 10, 2017, 08:53:55 PM

Quote from: s2 on September 08, 2017, 12:21:13 PM

Quote from: osmanadak on September 02, 2017, 01:45:21 PM

Quote from: s2 on September 02, 2017, 09:01:58 AM

$dbh->prepare('SELECT * FROM users WHERE username = "'.$_POST['username'].'" AND password = "'.$password.'"');

Thank you for comment. Users install it to their server. So it can be close system.

But i am open for suggestions for SQL injection

I believe in PHP you can use '?' in the prepare statement part and later user bind to assign either a string or integer to each item. For instance your line would become

Code:

$select = $dbh->prepare('SELECT * FROM users WHERE username = ? AND password = ?);
if (!$select->bind_param ("ss", $_POST['username'], $_POST['password'] ) do_error_handling_and_exit();
if (!$select->execute ()) do_error_handling_and_exit();

Thank you. Still waiting for comments from other users. I started to work for bittrex.

Bittrex is a good plateform, good luck Wink