Q:

how to work php sql injection and use in site?

 1. how to work php sql injection and use in site ?

my site login process easily login any person with out username & password.plz describe how to safe login process.
example :
$logindetail = "select * from tablename where username = '".$_REQUEST['username']."' and password = '".$_REQUEST['password']."' ";

$sqlrun = mysql_query($logindetail);

$recordcount = mysql_num_rows($sqlrun); 

in this login process how would sql injection be used?

A:

It's not clear whether you're asking for someone to explain how to prevent SQL injection, or how someone might use SQL injection to get into your site.
To prevent SQL injection, use parameterised queries.  This has already been well explained in this question: How can I prevent SQL injection in PHP?
If someone realised your site was vulnerable to SQL injection, they could log on to your site as any known username, by entering this into the username box
admin' OR 1=1 -- 

This makes the SQL that is executed on the database server:
"select * from tablename where username = 'admin' OR 1=1 -- and password = '' "

The OR 1=1 will evaluate to true and the -- comments out the rest of the SQL string and prevent the password check.  
I'm not going to get into password hashing, as I assume this is a small example.

A:

use mysqli or PDO preprared statements to execute a query. mysql is deprecated.Something like this:-
<?php
     $con = new mysqli('host','user','pass','db');
     if(!$con)
       die();
     $stmt = $con->prepare("select * from tablename where username = ? and password =?");
     $stmt->bind_param('ss',$_REQUEST['username'],$_REQUEST['password']);
     $stmt->execute();
     $stmt->close();

This can be a more safer way to stop SQL injection. Learn more from Here

A:

Change first line to: 
$logindetail = "select * from tablename where username = '".mysql_real_escape_string($_REQUEST['username'])."' and password = '".mysql_real_escape_string($_REQUEST['password'])."' ";

