I want to know that how can i read the contents of db say username and password to an array and then check the login using array and hence avoiding any chance of sql injection???

I want to know that how can i read the contents of db say username and password to an array and then check the login using array and hence avoiding any chance of sql injection???

 

Hi,

 

I'm not sure why you want to use an array... Can you give some example code?

Yes I'm also confused about why u would need to use an array?

He means using a closed query to populate an array, then do the comparison check on the user array with the post vars.

 

Yes you can do that, but at the expense of performance. Sanitizing the user input and using a prepared SQL statement is adequate protection against SQL injection.

Ahh ok, well i've never done it this way! atiprashant do you have a code example??

Sanitizing the user input and using a prepared SQL statement is adequate protection against SQL injection.

 

This is what I'd have suggested but wanted an example of what he was trying to do...

 

He means using a closed query to populate an array, then do the comparison check on the user array with the post vars.

 

Yes you can do that, but at the expense of performance.

 

Would it be that bad on performance?

Depends on your user base, but take this forum for example... selecting 7000 users, looping through them and finding a matching record is going to be a lot less efficient than conditionally selecting 1 record. Even if you were using an efficient binary search algorithm, I'd imagine memory usage would go through the roof.

Depends on your user base, but take this forum for example... selecting 7000 users, looping through them and finding a matching record is going to be a lot less efficient than conditionally selecting 1 record. Even if you were using an efficient binary search algorithm, I'd imagine memory usage would go through the roof.

 

Yo,

 

His experience profile says:

 

Experience:

Beginner

Area of Expertise:

I'm Learning

 

So I doubt he has a large user database in need of such methods

 

If you are talking thousands or millions of users then yeah perhaps the apache/sql server might freak out

Just because you're are a beginner or you're operating a small site it doesn't mean you should use bad design practice. Looping through a database record dump is always going to be slower than just conditionally selecting 1 record from MySQL.

Just because you're are a beginner or you're operating a small site it doesn't mean you should use bad design practice. Looping through a database record dump is always going to be slower than just conditionally selecting 1 record from MySQL.

 

You used an example with 7,000 records mate... We never mentioned looping through a record dump, you did.

 

We were asking him for code examples so we could try and point him in the right direction.

You used an example with 7,000 records mate... We never mentioned looping through a record dump, you did.

 

We were asking him for code examples so we could try and point him in the right direction.

 

I just used that number as an example, it doesn't matter how many user accounts you have, 7000, 1, 10000000, that method is always going to be slower than conditionally selecting one record, therefor he shouldn't do it. And I know you never mentioned looping through a user dump, the OP implied it by reading the contents of a db into an array. How else would you search the array without iteration?

I just used that number as an example, it doesn't matter how many user accounts you have, 7000, 1, 10000000, that method is always going to be slower than conditionally selecting one record, therefor he shouldn't do it. And I know you never mentioned looping through a user dump, the OP implied it by reading the contents of a db into an array. How else would you search the array without iteration?

 

Fair comment... I was a bit hasty with my reply there mate hehe