From f97cf90f6426ca029ab138bcb9328aa053500be4 Mon Sep 17 00:00:00 2001
From: David Tajchreber <dtajchreber@php.net>
Date: Sun, 20 Feb 2011 22:41:18 +0000
Subject: [PATCH] bug #54041 - http post vars are set before processing.
 changed order to make example give shown output

git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@308511 c90b9560-bf6c-de11-be94-00142212c4b1
---
 reference/mysql/functions/mysql-real-escape-string.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/reference/mysql/functions/mysql-real-escape-string.xml b/reference/mysql/functions/mysql-real-escape-string.xml
index a423bb9cad..b98cf2eb24 100644
--- a/reference/mysql/functions/mysql-real-escape-string.xml
+++ b/reference/mysql/functions/mysql-real-escape-string.xml
@@ -83,14 +83,14 @@ $query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
     <programlisting role="php">
 <![CDATA[
 <?php
-// Query database to check if there are any matching users
-$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND password='{$_POST['password']}'";
-mysql_query($query);
-
 // We didn't check $_POST['password'], it could be anything the user wanted! For example:
 $_POST['username'] = 'aidan';
 $_POST['password'] = "' OR ''='";
 
+// Query database to check if there are any matching users
+$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND password='{$_POST['password']}'";
+mysql_query($query);
+
 // This means the query sent to MySQL would be:
 echo $query;
 ?>