sql injections

ravi951 · August 18th, 2011, 07:51 AM

hi all,
i have done simple login form with username="admin" and password="admin123".
i am checking for sql injections.i have given "mysql_real_escape_string"
for both username and password fields.
but also it is not working......
if i give username as "admin --" and click the submit button(not giving password also) it is taking to the next page...
tell me whats wrong in my below code.....

Code:

<?php
session_start();
mysql_connect("localhost","root","");
mysql_select_db("test");
if(isset($_POST['sub']))
{
$username=mysql_real_escape_string($_POST['txtuname']);
$password=mysql_real_escape_string($_POST['txtpwd']);
$check=mysql_query("SELECT DISTINCT `username`,`password` FROM `log` WHERE `username`='$username'") or die("Error: " . mysql_error());
while($find = mysql_fetch_array($check)) 
 {
 list($username,$output) = $find;
 }
if($password==$output) 
 { 
$_session['si']=session_id();
echo "<script> location='view1.php'</script>";
 }
else
echo "invalid";
}
?>
<table width="200" height="150" bgcolor="lightblue" border="1" align="center">
<tr><td style="font-size:25;color:red" align="center" colspan="2">Login Form </td></tr>
<form method="post" action="">
<tr><td align="right" width="100">
Username:</td><td><input type="text" name="txtuname" </td></tr>
<tr><td align="right" width="100">
Password:</td><td><input type="password" name="txtpwd" </td></tr>
<tr><td align="right" width="100">
<input type="submit" value="login" name="sub" </td></tr>
</form>
</table>

GeneBuchite · August 24th, 2011, 01:48 PM

You need to test for null password entry...

Code:

 if(empty($password)) {
    die('NO PAssword Entered Please use your browsers back button to try again with a valid password');   
}
if($password==$output)

UseLess · August 26th, 2011, 07:02 AM

Greetings,

Also you cannot use this:

Code:

$username=mysql_real_escape_string($_POST['txtuname']);
$password=mysql_real_escape_string($_POST['txtpwd']);

the 'mysql_real_escape_string' is supposed to be used before submitting information to the database, not to remove things the user may have entered on a form.

ravi951 · August 26th, 2011, 07:19 AM

then what would be the solution to overcome sql injections.
means user cannot log unless he knows password

UseLess · August 27th, 2011, 09:09 AM

Greetings,

Using 'mysql_real_escape_string' on the username is fine, as you're using this user supplied input to obtain the username / password from the db. However 'normally' the password will be stored in the db after it's been hashed with the likes of MD5 and as such using 'mysql_real_escape_string' on it is a waste of time as $password is hashed, and hashing also sanitises data. Anything passed through a hashing function like md5() or sha1() is returned in hexadecimal. Meaning that only 0-9 and a-f characters can be returned by the function.