ulr.de/test.php?f=index

<?php

$f = $_REQUEST['f'] . 'php';

include($f);

?>

<?php

$f = ereg_replace('..', '', $_REQUEST['f'])
$f = ereg_replace('/', '', $f);
$f .= '.php';

include(addslashes($f);

?>

$query = " select `id` from `benutzer` where 
                `name`='".$_POST['name']."' and
                `passwort`='".$_POST['passwort']."' Limit 0,1";

 where md5(benutzername) = '".md5($_POST['benutzer'])."' and md5(passwort) = '".md5($_POST['passwort'])."'

<?php
class Filter{
	
	const EMAIL_PATTERN = '%^([a-zA-Z0-9])+([a-zA-Z0-9\._-])*@([a-zA-Z0-9_-])+([a-zA-Z0-9\._-]+)+$%';
	const PASSWORD_PATTERN = '%^[a-zA-Z0-9\_\$\+\*\ç\%\&\/\(\)\?\§]+$%';
	const USERNAME_PATTERN = '%^[a-zA-Z0-9\-_]+$%';
	
	public static function htmltags_array($content){
		$stripped = array();
		foreach($content as $key=>$value) {
			$stripped[$key] = strip_tags($value);
		} return $stripped;
	}
	public static function htmltags($content){
		if (strip_tags($content) == $content){
			return true;
		} return false;
	}
	public static function username($content, $length=0){
		$length_check = true;
		if(!empty($length)) {
			$length_check = self::length($content, $length);
		}
		if(preg_match(self::USERNAME_PATTERN, $content) && $length_check){
			return true;
		}else {
			return false;
		}
	}
	public static function password($content){
		if (preg_match(self::PASSWORD_PATTERN, $content)){
			if (self::length($content, 6) && !is_numeric($content)) {
				return true;
			} else {
				return false;
			}
		}else {
			return false;
		}
	}
	public static function email($content){
		if(preg_match(self::EMAIL_PATTERN, $content)) {
			return true;
		} return false;
	}
	public static function length($content, $lenght){
		if (strlen($content) >= $lenght){
			return true;
		} else {
			return false;
		}
	}
}
?>

<?php
require_once('Pfad/Filter.class.php');

if (Filter:username('##username##, '##mindestlänge(optional)##') && Filter:password('##username##)){
   mysql_connect('##host##', ##username##', '##password##');
   mysql_select_db('##db##');

   $sql="SELECT COUNT(*) FROM ##db## WHERE password=MD5('".mysql_real_escape_string('##password##').'") AND username='".mysql_real_escape_string('##username##')."'";
   mysql_query($sql);
   mysql_fetch_assoc();
} else {
   return false;
}
?>

SELECT * FROM tab WHERE user = '$_POST['user']' AND pass = 'md5($_POST['pass'])'

if($_POST['user'] == $value ['user'] AND md5($_POST['pass']) == $value ['pass'] )
{
     // user logged in
     .....
}