登录表单的简单SQL注入解决方案？

Question

I saw several examples and people using this way to query the database in a login form. I'm not fully sure is this is the best way to do a login form secure.

This is the query in PHP:

    $query = "SELECT * FROM users WHERE usern = '".$_POST['username']."' AND passw = '".md5($_POST['password'])."'";

Is enough having md5() on the password post to avoid sql injection?. I think that the md5 function will convert all characters and sql strings to a 32 char string.

Which other ways can I protect the login form?

Answer 1

mysql_real_escape_string($_POST['username']) , etc.

Although it's better to use the mysqli extension and use prepared statements.

(Assuming you're using MySQL)

Edit: In response to the comment below, it might be good to use this for LIKE queries:

addcslashes(mysql_real_escape_string($_POST['username']), '%_')

Answer 2

Just one simple solution use parameters for fields like username and password so that SQL command string is separably sent from the parameters and then attacker will only get blank responses.When parameters are used SQL command string is parsed and compiled separately from the parameters. Using prepared statements is the best solution.

Answer 3

You must sanitize your data before you let it near your database. The simplest way to do this is by using mysql_real_escape_string($_POST['username']) but this is only the very least you need to do.

If you're using a framework like CodeIgniter, you can use their in-build functionality which strips $_POST or $_GET inputs of any XSS risk. Otherwise, I'd recommend these posts:

• What's the best method for sanitizing user input with PHP?
• Clean & Safe string in PHP

Answer 4

You need to escape $_POST['username'] as well

and yes md5 will protect you from sql injection.

For this example, something like this would be ok

$query = "SELECT * FROM users WHERE MD5(usern) = '".md5($_POST['username'])."' AND passw = '".md5($_POST['password'])."'";

Answer 5

The way you have build your query easily allows to inject pieces of code in the username. You can use prepared statements to avoid that: http://php.net/manual/en/pdo.prepared-statements.php

Prepared statements basically will describe how the statement will be structured, and adds the data afterwards. This way, the user can not alter the structure of the statement with the input data.

Answer 6

If you make a function which sanitizes all POSTS and GETS you are safe

function clean() { 
    foreach($_POST as $key => $val) { 
        $_POST[$key] = mysql_real_escape_string($val);
    } 
}

You can also use PDO and statements with variables, and PDO will clean automatically.

Answer 7

<?php

try {
    $dbh = new PDO("mysql:host=$hostname;dbname=$db", $dbusername, $dbpassword);

    $query = "SELECT * FROM users WHERE usern = ? AND passw = ?";
    $sth=$dbh->prepare($sql);
    $sth->execute(array($_POST['username'], md5($_POST['password']));
    $result =  $sth->fetch();
}
} catch(PDOException $e) {
    echo $e->getMessage();
    exit;
}

PDO is the Best way to stop SQL Injection in PHP