title: is my php code vulnerable to sql injections
body: <p>a friend of mine told me that using this script to authenticate users is real risk to sql vulns</p>
  
  <pre><code>&lt;?php
  if(strlen(strstr($_SERVER['HTTP_USER_AGENT'],"-- IPB Vaidation  --")) &lt;= 0 ){ 
  die('Login Failed!, Please try again.');
  }
  $name = strtolower($_GET["name"]);
  $password = $_GET["password"];
  $digits = $_GET["digits"];
  $random_number = 70; 
  $sum_total2 = $digits * $random_number;
  $con = mysql_connect("127.0.0.1","usernamehere","passhere");
  if (!$con)
    {
    die('Could not connect: ' . mysql_error());
    }
  mysql_select_db("database here", $con);
  $sql = "SELECT * FROM ipbmembers WHERE members_seo_name='{$name}'";
  $result = mysql_query($sql) or die(mysql_error());
  while($row = mysql_fetch_array($result))
    {
    $trueHash = $row['members_pass_hash'];
    $salt = $row['members_pass_salt'];
    }
  $hash = md5(md5($salt) . md5($password));
  if($hash == $trueHash)
  {
  echo "Thank you for logging in";
  echo ($sum_total2);
  }
  else
  {
  echo "Login Failed!, Please try again.";
  echo ($sum_total2);
  }  
  ?&gt;
  </code></pre>
  
  <p>can anyone show me how its done? or what iam doing wrong?    </p>
  
  <p>Thanks!</p>