As an attacker, he will start by guessing the query sql statement to verify the username and password. By looking at the source files, he can start guessing your habits. For example, naming habits. It is usually assumed that the field names in your form are the same as the field names in the data table. Of course, ensuring they are different is not necessarily a reliable security measure. |