arkadaslar asagıdaki kod'da sql açıgı var tam olarak kapatabilir misiniz!
Şerefsiin biri sürekli katagorileri hackliyor yardım eden biri warmi?
<?php

session_start();



//$_SESSION['login_pass'] = $login_pass;

//$_SESSION['login_user'] = $login_user;



session_register("login_pass");

session_register("login_user");

include "baglan.php";



$tablo_login = "SELECT * FROM login WHERE user = '$login_user' AND pass = '$login_pass' ";

$sorgu_login = mysql_query($tablo_login);

$pass = @mysql_result($sorgu_login, 0, "pass");





if(mysql_num_rows($sorgu_login) > 0) {

    header("Location: giris.php");

}



$tablo_login = "SELECT * FROM login";

$sorgu_login = mysql_query($tablo_login);

if(empty($HTTP_POST_VARS)) {

include "head.php";

?>

<body  leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">

<br>

<FORM METHOD="POST" ACTION="index.php">

<table width="400" background="images/bg50.jpg" border="0" align="center" cellpadding="2" cellspacing="2">

 <tr>

    <td align="center" background="images/bg50.jpg"><img src="images/logogiris.jpg" width="400" height="100"></td>

 </tr>

</table>



<table width="400" background="images/bg50.jpg" border="0" align="center" cellpadding="2" cellspacing="2">

 

  <tr>

    <td colspan="2" background="images/bg30.jpg" height="30" align="center"><b>Yönetim Paneli Girisi</b></td>

    

  </tr>

  <tr>

    <td ><b>Kullanici Adi</b></td>

    <td ><input class="input" name="user" type="text" id="kullanici_adi" size="25"></td>

  </tr>

  <tr>

    <td><b>Sifre</b></td>

    <td><input class="input" name="pass" type="password" id="sifre" size="10">

      <input class="buton" name="giris" type="submit" id="giris" value="Giris"></td>

  </tr>

 

</table>

</FORM>

<br><br>

<center>

</center>

<?php

}else{          <-- ///özel karekter kullanmayı engelleyici kod fonksiyon bilen warsa..\\\\\

    $user = $HTTP_POST_VARS["user"];    <-- ///bu alanalara dikkat \\\\\

    $pass = $HTTP_POST_VARS["pass"];    <-- ///bu alanalara dikkat\\\\\

    $pass = md5($pass);



    $tablo_login = "SELECT * FROM login WHERE user='$user' AND pass='$pass'";

    $sorgu_login = mysql_query($tablo_login);



    if(mysql_num_rows($sorgu_login) < 1) {

        header("Location: index.php");

    }else{

        $login_pass = @mysql_result($sorgu_login,0,"pass");

        //$_SESSION['login_pass'] = $login_pass;

        session_register("login_pass");

        

        $login_user = $user;

        session_register("login_user");

        

        header("Location: giris.php");

    }

    mysql_close();

}

?>