sql injection

sakiran · Aug 26, 2017 · 8bbdf21 · 8bbdf21
1 parent 9edafdc
commit 8bbdf21
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/php/login.php b/php/login.php
@@ -3,10 +3,11 @@
 session_start();
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
     // username and password received from loginform
-    $username  = mysqli_real_escape_string($dbconfig, $_POST['username']);
-    //$username  = $_POST['username'];
-    $password  = mysqli_real_escape_string($dbconfig, $_POST['password']);
-    //$password  = $_POST['password'];
+    //$username  = mysqli_real_escape_string($dbconfig, $_POST['username']);
+    $username  = $_POST['username'];
+    //$password  = mysqli_real_escape_string($dbconfig, $_POST['password']);
+    $password  = $_POST['password'];
+	//keerthana ' or username = 'keerthana
     $sql_query = "SELECT userid FROM usermanagement WHERE username='$username' and password='$password'";
     $result    = mysqli_query($dbconfig, $sql_query);
     $row       = mysqli_fetch_array($result, MYSQLI_ASSOC);