php self method creating error

Asked Nov 01 '15 at 14:27

Active Nov 01 '15 at 14:58

Viewed 19 times

i have a login page i have used

 <?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>

now i was trying an whenever i enter

  http://www.twekr.com/login.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E

& it gaved me this error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'hacked')%3C/script%3E', 0)' at line 2

What should i do now?

  $uemail = "";
  $upass = "";
  if ($_SERVER["REQUEST_METHOD"] == "POST")
  {

   $uemail  =  test_input($_POST['email']);
  $upass   =  test_input(md5($_POST['password']));

   if(empty($uemail) or empty($upass)){

 $message = "Please enter email or password";

  } else {
  $check_login = mysql_query("SELECT username FROM users WHERE email 
  ='$uemail' AND password ='$upass'");
    if(mysql_num_rows($check_login) ==1) {



     $get = mysql_fetch_array($check_login);
  $_SESSION['username2'] = $get['username'];

     $_SESSION['semail'] = $uemail;
header('Location:http://twekr.com/');exit;
    }else { 
         $message = "Wrong email or password";
     }
 }
  }
  ?>

edited Nov 01 '15 at 14:58

asked Nov 01 '15 at 14:27

abhishek

You'd need to add the code that is in the login page - especially the database interaction code. – Professor Abronsius Nov 01 '15 at 14:28
What are you trying to achieve? The PHP code is fine, the URL shows you are trying to run a script. – Lucky Chingi Nov 01 '15 at 14:30
1

The code given here does not explain the error you mention, which comes from the database. – Professor Abronsius Nov 01 '15 at 14:31
if i try using this code on other login page nothing happens then why on my website login? – abhishek Nov 01 '15 at 14:32
what should i do now? @RamRaider – abhishek Nov 01 '15 at 14:43
Post the code from your login page would be helpful in diagnosing the problem – Professor Abronsius Nov 01 '15 at 14:52
now see the changes @RamRaider – abhishek Nov 01 '15 at 14:58

php self method creating error

0 Answers0