majid-razzaq / php-resumemaker Goto Github PK

Please never use this Site public.
The problem with this, is that if it is based off of user input, like in the example, then a malicious user could do ' OR '1'='1. Now this statement will always evaluate to true, since 1=1. In this case, the malicious user now has access to your entire table. Just imagine what could happen if it were a DELETE query instead. Take a look at what is actually happening to the statement.
SELECT * FROM register WHERE email='' OR '1'='1'
A hacker could do a lot of damage to your site if your queries are set up like this.
An easy fix whould be to use real_escape_string but better inform about mysqli prepared statements

BAD:
$query = mysqli_query($con,"select * from register where email='$mail' && password='$pass' ");

Good:
$stmt = $mysqli->prepare("SELECT * FROM register WHERE email= ? AND password= ?");
$stmt->bind_param("ss", $mail, $pass);
$stmt->execute();
...
$stmt->close();