I believe this statement is vulnerable for injection, but am unsure.    Any help in this regard?  Thanks.  function CheckUserLogin($userName,$password) {     $sql="SELECT user_id           FROM users           WHERE user_name='".addslashes($userName)."' AND password ='".addslashes($password)."'";         $this-&gt;query($sql);     if($this-&gt;movenext()&gt;0)     {         return $this-&gt;col['user_id'];        }     else      {         return false;     } }   The query function is as such  function query($_query){     list($usec, $sec) = explode(" ",microtime());     $time_start  = ((float)$usec + (float)$sec);       $this-&gt;query = $_query;     $this-&gt;result = @mysql_query($_query, $this-&gt;link_id) or die("&lt;b&gt;error in sql query&lt;/b&gt;&lt;br&gt;&lt;pre&gt;".$_query."&lt;/pre&gt;.mysql error : &lt;b&gt;".mysql_error($this-&gt;link_id)."&lt;/b&gt;&lt;p&gt;");      list($usec, $sec) = explode(" ",microtime());     $time_end  =  ((float)$usec + (float)$sec);     $time = $time_end - $time_start; }
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
How do I force TeX to completely use the 1st column? How do I force TeX to completely use the 1st column before writing to the second column?  Right now I dont have enough content to fill one whole page. So the left and right columns are equally filled, leaving 25% symmetrical empty page at bottom. How do I fill the left column first, and then the right?  \documentclass{article}  \usepackage{multicol} \usepackage[scale=0.9]{geometry} \usepackage{amssymb} \renewcommand{\labelitemi}{\tiny$\blacksquare$} \begin{document} \begin{multicols}{2}      %lots of text goes here  \end{multicols} \end{document} How to remove/install a package that is not fully installed? How do I create an Ubuntu live USB using a Mac? Disallow downvoting other answers if I've posted my own Possible Duplicates:        As Dan Dyer mentioned in his comment on , there is a conflict of interest when you have posted your own answer and are allowed to downvote other answers.  Despite the vote editing window being drastically reduced, the fundamental problem remains: I can downvote the other answers permanently and still benefit - my answer gets upvoted ONCE and wham, I have just made up the rep loss for my 10 other downvotes. The vote editing window fixes part of the problem, but there is a more complete fix that has the extra benefit of not preventing legitimate vote changes: to disallow downvotes on competing answers when you have posted one yourself.  The temptation to wrongfully downvote competing answers is huge. The rep loss is tiny in comparison. It has to be in order for people to continue to legitimately downvote.  Details:   If I have previously voted and then post my own answers, delete my downvotes. Continue to allow me to remove the upvotes - I think this is fully legitimate. If I delete my answer it's probably best to continue to deny downvotes (perhaps even including the question), but I don't have a strong opinion either way. What is the formula for Real vs Apparent Depth, when not looking perpendicular to the interface?   I know the formula $$\frac{\text{real depth}}{\text{apparent depth}}=n$$   but I'm not looking for this. Is there a sentence that begins with “them”? I haven't found a similar question on here, though I suspect the question may be rather well-covered.   I want to find a conformal map from the vertical strip $\{z:-1&lt;Re(z)&lt;1\}$ onto the unit disc.  Under the exponential map the region is taken to the annulus with radii $e$ and $e^{-1}$, but I'm not sure how useful this will be.  Can anyone advise on what the conformal map may be?  Thanks. How to highlight paragraph (linebreak preserving) as well as itemize, tabular etc.? I want to highlight changes which are introduced by myself in the pdf document. So far the soul package is very neat but it does throw errors when I want to highlight not only paragraphs but also some itemize environments, and I don't want to highlight the items separately. Also the \cite{...} command is not supported by \hl. I recently posted a slightly different question:   BTW: What I liked most over other approaches like pdfcomments etc. is that the \hl command from soul has a very exact and clear output, no icons, no clicking etc. involved. Together with todonotes it's very good and almost all I need. Prove convergence of the sequence $(z_1+z_2+\cdots + z_n)/n$ of Cesaro means Prove that if $\lim_{n \to \infty}z_{n}=A$ then:  $$\lim_{n \to \infty}\frac{z_{1}+z_{2}+\cdots + z_{n}}{n}=A$$ I was thinking spliting it in: $$(z_{1}+z_{2}+\cdots+z_{N-1})+(z_{N}+z_{N+1}+\cdots+z_{n})$$ where $N$ is value of $n$ for which $|A-z_{n}|&lt;\epsilon$ then taking the limit of this sum devided by $n$ , and noting that the second sum is as close as you wish to $nA$ while the first is as close as you wish to $0$. Not sure if this helps.... An example of a lattice that's not totally ordered Easiest way to read from and write to files 'setenv' command not working on tcsh shell when called explicitly I can run setenv command just fine in my tcsh shell like this:  echo $0 /usr/bin/tcsh echo $SHELL /usr/bin/tcsh setenv START_TIME `date +%s` echo $START_TIME 1499355967   But, whenever I run it explicitly like shown below, it doesn't work. I need to do this because I have to specify shell when executing it via python subprocess call, otherwise it will call a sh shell as default.  /usr/bin/tcsh -i -f -c 'setenv START_TIME `date +%s`' echo $START_TIME START_TIME: Undefined variable.   What's the problem here? I searched for this issue online, but couldn't find any issue similar to this. This is extremely frustrating. Consider the general linear regression model: $$y_i = \beta_0 + \beta_1x_{i1} + \beta_2x_{i2} + \cdots + \beta_px_{ip} + \epsilon_i = \mathbf{x}_i^t \beta + \epsilon_i$$  where $\textbf{x}_i = (1,x_{i1},x_{i2},\cdots,x_{ip})^T$, $\beta=(\beta_0,\beta_1,\cdots,\beta_p)^T$ and $\epsilon_i$ are iid N(0,$\sigma^2$).  I would like to see a complete proof of the following identity from first principles: $$\sum_{i=1}^n(y_i - \bar{y})^2 = \sum_{i=1}^n(\hat{y}_i - \bar{y})^2 + \sum_{i=1}^n(y_i - \hat{y}_i)^2$$ where $\hat{y}_i= \mathbf{x}_i^t \hat{\beta} $ ($\hat{\beta}$ is the least square estimator, $\bar{y}$ ia the sample mean of $y_i$).  I know that the two terms on the right can be obtained by subtracting and adding $\hat{y}_i$ on the left side. But this introduces a "cross term": $$\sum_{i=1}^n2(\hat{y}_i - \bar{y})(y_i - \hat{y}_i)$$  Many texts claim that this is zero, but I have not seen a general proof of this statement. How can this be shown? Cannot remove any bluetooth device I frequently find myself needing a word to express happiness that acknowledges a tragic or unfortunate circumstance underpinning that happiness. Preferably the word could have both adjective and verb forms. For example, "Gregory [verb-ed | felt adjective about] the balmy February day, suspecting it was yet another consequence of catastrophic and irreversible climate change."  "Bittersweet" is close, but not precisely right. It implies ambivalence rather than genuine gladness. "Schadenfreude" is also in the neighborhood, but I don't want to imply that the tragic part of the situation is what causes the pleasure. (Also, I recognize that the word may not quite exist in English, and I don't know if this is forbidden for this forum, but I'd welcome a loan word or phrase if there's a better one.) Short story with competitors complaining to government about a new very popular synthetic food Assuming I have a Czech license and break a minor law in Germany which incurs me a certain number of "violation points" (e.g. speeding), would those points be eventually transferred to my Czech license? I would obviously have to pay the fine (either on the spot or by mail), but it's not clear if EU countries exchange data on traffic points.  I would limit the scope to EU/EEA license holders driving within the EU/EEA, to avoid an overly broad question. Also assume that the person in question is resident in his home country and is only visiting other EU/EEA countries as a tourist. The comment with the Flagged Posts that seems to be new as of today states there are posts with flags awaiting my attention but the counter shows zero and when I go into flagged posts there is nothing waiting for me. Is the Ohm's law violated here? And also why is electricity generated at 11,000 V in India? Easiest way to solve $y''+y=\frac{1}{\cos x}$