Ricardo González
95c5441b5d
Remove single quotes for $user and $pass inside $query, since $pdo->quote() will quote the string for use in a query.
30 lines
672 B
PHP
30 lines
672 B
PHP
<?php
|
|
require_once 'login.php';
|
|
|
|
try
|
|
{
|
|
$pdo = new PDO($attr, $user, $pass, $opts);
|
|
}
|
|
catch (PDOException $e)
|
|
{
|
|
throw new PDOException($e->getMessage(), (int)$e->getCode());
|
|
}
|
|
|
|
$user = mysql_entities_fix_string($pdo, $_POST['user']);
|
|
$pass = mysql_entities_fix_string($pdo, $_POST['pass']);
|
|
$query = "SELECT * FROM users WHERE user=$user AND pass=$pass";
|
|
|
|
//Etc…
|
|
|
|
function mysql_entities_fix_string($pdo, $string)
|
|
{
|
|
return htmlentities(mysql_fix_string($pdo, $string));
|
|
}
|
|
|
|
function mysql_fix_string($pdo, $string)
|
|
{
|
|
if (get_magic_quotes_gpc()) $string = stripslashes($string);
|
|
return $pdo->quote($string);
|
|
}
|
|
?>
|