Question

I’m working on a web app and I came across this code snippit

$email=$_POST['email'];
$pass=$_POST['pass'];
$pass=md5($pass);
$query=mysql_real_escape_string($email,$link);
//echo $query."<br>";
$sql=mysql_query("SELECT pass FROM users WHERE email='".$email."'",$link);
if($row=mysql_fetch_array($sql))
{

I think the programmer intended $query=mysql_real_escape_string($email,$link); to be $email=mysql_real_escape_string($email,$link);

Do I have the right idea here?

Answer 1

Yes, you’re absolutely right – just correct that part, like you said, by changing it to

 $email = mysql_real_escape_string($email, $link);

, and that will protect against SQL injection there.

On a side note, I suggest you use hash("sha512", xxx) instead of md5 because MD5 is becoming obsolete. If your column size doesn’t allow for that though and you don’t have the ability to change it, it’s still OK.