Potential leak of data: Simple Password

Detected 1 occurrence(s) of ‘\s*pass[word]+\s*[:=]\s*["'][a-z0-9\-_\!\$]+["']‘: function login($user, $pass){ $errors = array(); $user = mysql_real_escape_string($_POST['user']); $pass = md5(mysql_real_escape_string($_POST['pass'])); $query = mysql_query("SELECT username FROM users WHERE username = '$user' AND password = '$pass'") or die(mysql_error()); $total = mysql_num_rows($query); if($total > 0){ //login session_start(); $_SESSION['username'] = $user; header('Location: user.php'); }else{ $errors[] = 'Invalid username or password'; } Source: […]