Use "anti_injection" in a MD5 password

Question

I am studying a little more in depth the PHP and in question of security in PHP I have used the standard anti_injection found on the internet and used by many

function anti_injection($sql){
$sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"), "" ,$sql); // remove palavras que contenham sintaxe sql
$sql = trim($sql); // limpa espaços vazios
$sql = strip_tags($sql); // tira tags html e php
$sql = addslashes($sql); //  adiciona barras invertidas a um string
return $sql;

}

But when doing some tests in login system, I used an anti_injection in the password and then I converted it to MD5 to check the database, my password registered in the database was not giving me access to the system, when I thought of something: my password had * (asterisk) and in preg_replace() the anti_injection removes the asterisks

My question is: need to put anti_injection in a password, and it will pass MD5 before being compared in the query

    $senha = $_POST['senha'];
    $senha_md5 = md5($senha);

    $query = "SELECT * FROM usuarios WHERE login = '$usuario' AND senha = '$senha_md5' AND status = '1'";

You should use anti_injection but remove * (asterisk) from preg_replace or do not need to use anti_injection??

Answer 1

Following guy, as you are converting to md5 only this would already prevent the attack of sqlinjection, however the recommended is to use Prepared statements of PDO.

You’d have to treat the user in every way, and then you’d have problems with that.

Using the PDO would look something like this:

$query = "SELECT * FROM tabela WHERE username = ? and password = ?";
$stmt = $pdo->prepare($query);

$username = $_POST["username"];
$password = md5($_POST["password"]);

$stmt->bindValue(1, $username);
$stmt->bindValue(2, $password);

$ok = $stmt->execute();
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

Take a look at the PDO documentation: http://php.net/manual/en/class.pdo.php

It’s worth taking a look at.

Answer 2

There is no need to convert or remove anything unless your business rule requires you to create a password with limitations. This, personally I find horrible because the more complex the password, the better. With this, I would only be discouraging the user to create safe passwords.

But anyway, that depends on your business model. Suddenly it can be a simple system where you will only allow alphanumeric passwords, or only numerical ones, anyway. But I don’t think that’s your case.

Returning to the subject, if the string will be compared as a hash, simply pass the string already converted to hash in the SQL query.

Let’s see in practice:

$senha = "'; delete from users; --"; // aqui temos uma injeção sql bem grosseira.
$query = "SELECT campo FROM tabela WHERE senha = '".$senha."'";

This will produce a query with an SQL injection:

SELECT campo FROM tabela WHERE senha = ''; delete from users; --'

Simple and logical way to solve

For your specific case, as I mentioned in the first sentence of this reply, no need to filter SQL injection.

An MD5 hash does not contain characters that could compromise the query with injections.

I’ll show you the reason with a simple example:

$senha = "'; delete from users; --"; // aqui temos uma injeção sql bem grosseira.
$query = "SELECT campo FROM tabela WHERE senha = '".md5($senha)."'";

The query produced will be:

SELECT campo FROM tabela WHERE senha = '9dc8014996ca2a4a67e2448a6c9821e0';

Simple as that. In the hash there is nothing to be filtered against SQL Injection.

Can see where there is something that could compromise an SQL query in this string 9dc8014996ca2a4a67e2448a6c9821e0?

Let’s evaluate the function you posted in the question:

function anti_injection($sql){
$sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"), "" ,$sql); // remove palavras que contenham sintaxe sql
$sql = trim($sql); // limpa espaços vazios
$sql = strip_tags($sql); // tira tags html e php
$sql = addslashes($sql); //  adiciona barras invertidas a um string
return $sql;

Translating:

It is not allowed to use the words from, select, Insert, delete, wherem, drop table, show Tables.

Using the characters is not allowed \, --, *, #.

No spaces allowed at start or end.

Using HTML, CSS, Javascript tags is not allowed

Finally, make an escape in quotes (double or single)

All these processes are unnecessary and meaningless.

The only useful process would be the addslashes(), however, I recommend that you read this link: addslashes is the basics for security?

Also read this: Using addslashes against SQL injection is safe?