Quote:
Originally Posted by Deas_Voice
humour me all you want,
but think bigger, lets say you used this on your gigantic website with all sorts of stuff on; a sql database, forums, etc etc. i'm not the guy who knows what you can/cant do if you got ahold off the password, but lets say you could inject something into the sql database because you use php to get data from it. now that isnt a very good thing, right?
again; this are just my thoughts, and maybe i dont know everything there is about security, but i would rather be on the safe side then guessing that people can't do bad stuffs with the password i've provided.
|
wtf are you even talking about, there's nothing in the code that could lead to any kind of SQL injection. Obviously you don't use the same password for more than one thing.
The very worst that could happen is someone finds the password and sends some playercount data with an XSS attack in it to steal cookies from whoever accesses the site and login as them. This is only possible if the site is using bad security practices anyway (e.g. not httponly cookies).
Arbitrary PHP is not being executed, nor are any SQL queries, so I'm not sure how you get SQL injection from that.