您可以“ SQL注入” PHP变量比较吗？

Question

So something that I have been wondering about while working on a current project is if a simple variable comparison is in danger of "SQL Injection" type attacks when one of the variables is user entered.

My basic login functionality works by taking the user provided username and using a prepared statement to look it up in the profiles table. If a record is found, the profileID is then retrieved from the record and used to look up the user's password in another permissions table. If THAT query is successful then the user provided password is === against the retrieved password from the database.

So my question is, does that last step pose a risk? I have tried 'hacking it myself putting through values like a' == 'a' || 'a a' == 'a' || 'a in an attempt to falsely trigger the $pass === $checkPermRow['pass'] but it doesn't seem to do anything. Am I safe?

Answer 1

If you use prepared statements and pass the input as parameters to the prepared statement, you're safe from SQL injections. The parameters should be handled properly and it should not be possible that fragments of the passed parameters are interpreted as SQL code instead of data. That's the exact point of parameterization, ie, the separation of code and data parameters.

So it should not be possible to inject anything into the query. However, you should not store the passwords in plaintext but in a irreversible form as a hash using an appropriate hash function.

---

As for your question whether an injection is also possible in PHP itself: Yes, code injection can happen in any code that gets generated dynamically, so even in PHP.

However, you would need not just to generate the code dynamically but also execute it. PHP has some functions that execute PHP), eg, the eval function . However, you would probably not use constructs like this:

if (eval("return '$pass' === '$checkPermRow[pass]';"))

This would be vulnerable to PHP code injection and a a' == 'a' || 'a a' == 'a' || 'a would result in something like:

return 'a' == 'a' || 'a' === 'password from database';