PHP：在非SQL代码上注入代码？

Question

I've read about MySQL injection and how it's done. I have a doubt, how could a login code be attacked if it doenst get data from a database?

This is what my login code looks like:

if($_GET['login'] == "myname" && $_GET['password'] == "mypass"){
     echo 'welcome, admin.';
else
     echo 'login failed.'

ps: this is for practice sake only, I know hardcoded passwords shouldnt be used.

Answer 1

If there's no SQL database, there is no SQL injection.

The other common thing to watch out for is potential for XSS. This can be handled by simply escaping any user output. Since you don't output anything from the user at all in your example code, then I see no problem.