如何在网站上使用php sql注入和使用？ [重复]

Question

This question already has an answer here:

• How can I prevent SQL injection in PHP? 28 answers

 1. how to work php sql injection and use in site ?

my site login process easily login any person with out username & password.plz describe how to safe login process.

example :

$logindetail = "select * from tablename where username = '".$_REQUEST['username']."' and password = '".$_REQUEST['password']."' ";

$sqlrun = mysql_query($logindetail);

$recordcount = mysql_num_rows($sqlrun); 

in this login process how would sql injection be used?

</div>

Answer 1

Change first line to:

$logindetail = "select * from tablename where username = '".mysql_real_escape_string($_REQUEST['username'])."' and password = '".mysql_real_escape_string($_REQUEST['password'])."' ";