title: How to fix Server Status Code: 302 Found by SQL Inject Me Firefox Addon
body: <p>I scanned my login script using <a href="https://addons.mozilla.org/en-US/firefox/addon/7597" rel="noreferrer"><strong>SQL Inject Me</strong></a> Firefox addon</p>
  
  <p>According to the Test Results, my script was vulnerable to SQL Injection. Result by example</p>
  
  <pre><code>Results:
  Server Status Code: 302 Found
  Tested value: &amp;#49&amp;#39&amp;#32&amp;#79&amp;#82&amp;#32&amp;#39&amp;#49&amp;#39&amp;#61&amp;#39&amp;#49
  Server Status Code: 302 Found
  Tested value: &amp;#x31;&amp;#x27;&amp;#x20;&amp;#x4F;&amp;#x52;&amp;#x20;&amp;#x27;&amp;#x31;&amp;#x27;&amp;#x3D;&amp;#x27;&amp;#x31;
  Server Status Code: 302 Found
  Tested value: 1 UNI/**/ON SELECT ALL FROM WHERE
  Server Status Code: 302 Found
  Tested value: %31%27%20%4F%52%20%27%31%27%3D%27%31
  </code></pre>
  
  <p>My script </p>
  
  <ol>
  <li>login.php - Login form</li>
  <li><p>check-login.php - To check login detail and here is the code.</p>
  
  <p>$email = clean($_POST['username']);
  $pass = clean($_POST['password']);
  $user = "select * from tbl_admin where admin='$email' and pass='$pass'";</p>
  
  <p>// some code</p>
  
  <p>$_SESSION['login_mes'] = "You have successfully logged in !";
  header("Location:admin.php");
  exit();</p>
  
  <p>} else {</p>
  
  <p>$_SESSION['login_mes'] = "Invalid email address or password, please try again.";
  header("Location:login.php");
  exit();
  }</p></li>
  </ol>
  
  <p>The problems came when login failed. If I remove the </p>
  
  <pre><code>} else {
  
  $_SESSION['login_mes'] = "Invalid email address or password, please try again.";
  header("Location:login.php");
  exit();
  }
  </code></pre>
  
  <p>No failures detect by SQL Inject Me and how to fix this part?</p>