Security Login Anti Injection Mysqli

Asked

Viewed 57 times

0

I am the following doubt, I gave a good research, but I would like to know... My administrative login system I was using only addslashes, for search reason for greater security, I added real_escape_string.

I wonder if my system is safe this way, if methods and functions are in correct order so that the sql Injection attacks can be avoided.

if ( isset( $_POST['user_login'] ) && isset( $_POST['user_password'] ) && !empty( $_POST['user_login'] ) && !empty( $_POST['user_password'] ) )
{
    $db = new Mysql;

    $user_login = $db->con->real_escape_string(addslashes(trim($_POST['user_login'])));
    $user_password = $db->con->real_escape_string(addslashes(md5(trim($_POST['user_password']))));

    $db->query( "select * from users where user_login = '$user_login' and user_password = '$user_password'" )->fetchAll();
mysqli

  • I didn’t need any of that, just use a BIND on the variables. If there is no bind, you should only use real_escape_string (and set the correct charset). The more you put spurious things, the more trouble you create in the application.

  • @How to do my friend. Could you give me a safe example?

  • Just take out the addslashes, in your case (and this Trim is doubtful, search the site for "remove spaces in passwords"). About Binding, has many posts on the site already, worth a search for "SQL Injection"

  • See this post about use BIND or Escape

  • You mean I don’t need addslashes, only real_escape_string or BIND brings security to my system??? Where would you then use addslashes for example?

  • Exactly. Of course, this against Injection. Against other attacks, there is in other parts of the application you have to take care.

  • 1

    Better than md5 would use password_hash and password_verify which would entail altering that select

Show 2 more comments
No answers

Browser other questions tagged mysqli

You are not signed in. Login or sign up in order to post.