如何使用 Angular.js、PHP 和 MySQL 防止基于 SQL 查询的注入

Question

I have a issue.I have a login page made using Angular.js,PHP and MySQL.When user is typing the following credential ,it is able to login.

username-1' or '1' = '1' or '1
password- 1' or '1' = '1' or '1

I think this is the SQL query based injection.I am explaining my php code below.

login.php:

<?php 
require_once '../../include/dbconfig.php'; 
$dept_id = $_SESSION["admin_dept_id"];
$postdata = file_get_contents("php://input");
$request = json_decode($postdata);
$user_name=$request->user_name;
$user_pass=$request->user_pass;

$password =sha1(htmlspecialchars(trim($user_pass)));
$selquery = "SELECT * FROM db_user WHERE login_name='".$user_name."' and password='".$password."' and user_status='1'";
$selres = mysql_query($selquery); 
if(mysql_num_rows($selres ) > 0){
    $result=mysql_fetch_array($selres); 
    $_SESSION["admin_id"]=$result['user_id'];
    $_SESSION["admin_user_name"]=$result['first_name']." ".$result['last_name'];
    $_SESSION["admin_user_type"]=$result['user_type'];
    $_SESSION["admin_email_id"]=$result['email'];
    $_SESSION["admin_role_id"]=$result['role_id'];
    $_SESSION["admin_clg_id"]=$result['colg_id'];
    $_SESSION["admin_dept_id"]=$result['dept_id'];
    //$result['msg'] = 'Login successfull...';
}else{
    header("HTTP/1.0 401 Unauthorized");
    $result['msg'] = 'Invalid username or password, Please try again...';
}
echo json_encode($result);
?>

Here I need to prevent this credentials for login.Please help me to resolve this issue.

Answer 1

I suggest you read:

How can I prevent SQL injection in PHP?

In your case the problem is right here:

$selquery = "SELECT * FROM db_user WHERE login_name='".$user_name."' and password='".$password."' and user_status='1'";

For a quick fix, change it to:

$selquery = "SELECT * FROM db_user WHERE login_name='".mysql_real_escape_string($user_name)."' and password='".mysql_real_escape_string($password)."' and user_status='1'";

For a long-term fix, convert your code to use PDO.