Pass PHP variable in URL query

Question

This is the code placed in unlock.php:

> <?php require_once("../../db-config.php");
> 
> $Result = "ERROR, still locked..."; if (isset($_POST['User'])) { 
>         if (mysql_query("DELETE FROM LoginAttempts WHERE User='".$_POST['User']."'", $conn))
>                 $Result = "User Unlocked"; } if ($conn)
>         mysql_close($conn); echo $Result; ?>

I want to unlock a user, I'm trying like this but getting the error "Error still locked..." instead of "User unlocked":

http://example.com/unlock.php?User=Administrador

How should I pass the variable User=name in the URL?

don't bother, someone will unlock your whole database with sql injection pretty soon — e4c5
– e4c5, Commented Dec 15, 2016 at 9:57
Use $_GET instead of Post. GET if for getting parameters from URL, POST is for data submitted by a HTML form. And yes, you're not save for SQL injections at all. — Twinfriends
– Twinfriends, Commented Dec 15, 2016 at 9:58
@AmanRawat Yeah it will solve his problem, but it wont change anything that there's no security. SQL injection incoming. He should use prepared statements to avoid this. NEVER put get/post parameter directly into a query. — Twinfriends
– Twinfriends, Commented Dec 15, 2016 at 10:04
For learning prepared statements with PDO use this link w3schools.com/php/php_mysql_prepared_statements.asp — Aman Rawat
– Aman Rawat, Commented Dec 15, 2016 at 10:10

Raka Jacman · Accepted Answer · 2016-12-15 10:31:46Z

1

You can collect your URL params using $_GET. Or $_REQUEST (which collects from POST, GET and COOKIE).

Beware that this call:

http://example.com/unlock.php?User=Administrador' OR 1=1

will empty your LoginAttempts table.

At least sanitize your input with mysql_real_escape_string($_GET['User']).

edited Dec 15, 2016 at 10:31

answered Dec 15, 2016 at 10:14

Raka Jacman

312 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Nacionarte Over a year ago

Apache forbids the access by using this URI

Nacionarte · Accepted Answer · 2016-12-15 10:50:11Z

0

I've solved this by going to PHPmyadmin and deleting the corresponding failed login attempts entries in the db table.

Different approach solves the issue. I've already warned about the security concerns.

Thanks guys.

answered Dec 15, 2016 at 10:50

Nacionarte

333 bronze badges

Collectives™ on Stack Overflow

Pass PHP variable in URL query

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related