PHP: Injecting code on non-sql code?

Question

I've read about MySQL injection and how it's done. I have a doubt, how could a login code be attacked if it doenst get data from a database?

This is what my login code looks like:

if($_GET['login'] == "myname" && $_GET['password'] == "mypass"){
     echo 'welcome, admin.';
else
     echo 'login failed.'

ps: this is for practice sake only, I know hardcoded passwords shouldnt be used.

That is completely fine and impossible to get around. :)

DanRedux
– DanRedux

2012-04-30 04:54:57 +00:00
Commented Apr 30, 2012 at 4:54 — DanRedux
– DanRedux, Commented Apr 30, 2012 at 4:54

Brad · Accepted Answer · 2012-04-30 04:55:40Z

3

If there's no SQL database, there is no SQL injection.

The other common thing to watch out for is potential for XSS. This can be handled by simply escaping any user output. Since you don't output anything from the user at all in your example code, then I see no problem.

answered Apr 30, 2012 at 4:55

Brad

164k57 gold badges381 silver badges559 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP: Injecting code on non-sql code?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related