sql injection

lesson 50
sql injection
SELECT `id` FROM `users` WHERE `username` = '$username' AND `password` = '$pass_hash'
SELECT `id` FROM `users` WHERE `username` = '' or ''='' AND `password` = '' or ''=''
or ''='
	if we enter this thing in user name and password, it will be hacked, u can login into account
username is equal to nothing or nothing equal to nothing, it will true	to avaoid this use realesscape
using this details entered into register form,
or ''='    , if we entered into username and password
it will show it is login
to avoid this
open php.ini
check for this
magic_quotes_gpc=Off
change to on
check it any change like , if that is applied, it will shwo with that username and password
login or not , check it is login or normal, to check this server off and on
to overcome ths hacking
mysqli_real_escape
if md5 and greeter than equal to one, found out  ,matched
at that point we can faec solution
using real escap , place befor e \' like this
$password = mysqli_real_escape_string($mycon, $_POST['password']);