PHP error, oracle database and SQL code?

Question

Trying to do a PHP login page with oracle database.  Top is the code fragment, the bottom was the error given.  I already have the database connection code.  What is the right syntax for the below?

13      $s = oci_parse($c, "select * from employee where
eid='"$_POST['eid']"' and pwrd ='"$_POST['pwrd']"'");
14
15      oci_execute($s);


error:
Parse error: syntax error, unexpected T_VARIABLE in
/afs/csc.depauw.edu/home/dsolis/public_html/do_authuser.php on line 13

Adam B · Accepted Answer

This is tangential, but I thought you might want a pointer.  Your code may currently be vulnerable to a SQL injection attack - a malicious user could send unexpected POST data that would brreak up your query.

I definitely suggest doing some data validation here, if nothing else.

Also ensure that your data is properly escaped by doing an addslashes();  [For those using mySQL, use mysql_escape_string()]

spl · Answer

First off, you should be doing some error checking on the post variables but do some concatenating.
should read:

$s = oci_parse($c, "select * from employee where
eid=".$_POST['eid']." and pwrd =".$_POST['pwrd'].");

PHP error, oracle database and SQL code?

2 Antworten