I see you check for sql injection of the loginname:

$loginName = mysql_real_escape_string($loginName);

Do you filter bad content for the submitted password?

edit: now that I look at it, you are sending the POSTed login name straight to the SQL, aren't you?

this:

 new user($db,$_POST['username']); 

should be this:

 new user($db,$loginName); 

If I'm reading this correctly - you need to sanitize the password also!

This is generally very important. You are also using mysql functions to sanitize sql lite data. That's probably okay, but I wouldn't bet the farm on it!

I see you check for sql injection of the loginname:

$loginName = mysql_real_escape_string($loginName);

Do you filter bad content for the submitted password?

Now that I look at it, you are sending the POSTed login name straight to the SQL, aren't you?

This:

new user($db,$_POST['username']);
 

Should be this:

new user($db,$loginName); 
 

If I'm reading this correctly - you need to sanitize the password also!

This is generally very important. You are also using MySQL functions to sanitize SQLite data. That's probably okay, but I wouldn't bet the farm on it!

I see you check for sql injection of the loginname:

$loginName = mysql_real_escape_string($loginName);

Do you filter bad content for the submitted password?

edit: now that I look at it, you are sending the POSTed login name straight to the SQL, aren't you?

this:

new user($db,$_POST['username']); 

should be this:

new user($db,$loginName); 

If I'm reading this correctly.

I see you check for sql injection of the loginname:

$loginName = mysql_real_escape_string($loginName);

Do you filter bad content for the submitted password?

edit: now that I look at it, you are sending the POSTed login name straight to the SQL, aren't you?

this:

new user($db,$_POST['username']); 

should be this:

new user($db,$loginName); 

If I'm reading this correctly - you need to sanitize the password also!

This is generally very important. You are also using mysql functions to sanitize sql lite data. That's probably okay, but I wouldn't bet the farm on it!