prevent sql injection by converting string to arrays

Question

In my Login forms I hash username and password before I execute the queries

... class ...

private $username;
private $password;
protected function Login(){
    $user = hash('sha256', $this->username);
    $pass = hash('sha256', $this->password);
    $this query = "..."
    ...
}

and in other kind of forms (like Search forms) I convert the strings to arrays and then I execute the queries, that way the query would look like this:

$searchstring = explode(' ', $search);
//.... Some lines of PHP code... and the resulting query is: ...
$this->query = "SELECT... WHERE name LIKE 'DELETE%' OR name LIKE 'FROM%' ";
$this->query.= " OR name LIKE 'USERS%' OR name LIKE 'WHERE%' OR name LIKE '1%'";

Is this enough to prevent sql injection? thanks

Don't use addslashes(). If you use PDO or mysqli use the data binding features. If you are using the mysql_* functions (which you shouldn't) use mysql_real_escape_string(). — bobwienholt
– bobwienholt, Commented Aug 15, 2012 at 21:31
Use mysql function to escape strings or PDO library (which i personally prefer) — pinepain
– pinepain, Commented Aug 15, 2012 at 21:33
Why hash the username? I would've thought that would raise the risk of collision? Also, you should check with Security, but the usual recommendation is to add a salt, which you would need to retrieve (basically from the password record) before hashing the password. — Clockwork-Muse
– Clockwork-Muse, Commented Aug 15, 2012 at 22:27
Hashing usernames is at least ridiculous, hash everything and encrypt with random salts so you will never know who is who. — Anonymous
– Anonymous, Commented Aug 16, 2012 at 0:34

Anthony Mills · Accepted Answer · 2012-08-15 21:33:37Z

5

Don't trust in your own abilities to prevent SQL injection! Many better heads than yours have fallen to it.

Use mysqli or PDO and parameterized queries. This has the side benefit of allowing your database to cache query plans too.

answered Aug 15, 2012 at 21:33

Anthony Mills

8,7864 gold badges36 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

hakre Over a year ago

More a comment than an answer IMHO.

Anthony Mills Over a year ago

Sometimes you can't say "this is a safe way to do this incredibly unsafe thing you're doing."

MatBailie Over a year ago

+1 : What is it about geeks that they always try to reinvent the wheel?

hakre Over a year ago

Yes I will revert my opnion anyway as these other answers are so really bad.

Anthony Mills Over a year ago

The important part here is parameterized queries because they are good.

|

Community · Accepted Answer · 2017-05-23 10:34:39Z

0

There are some very easy steps you can take to make the code more secure:

$query= mysqli_real_escape_string($database_connection, $user)

this escapes any dangerous characters that can adversely affect SQL string

$query = mysqli_real_escape_string($database_connection, trim($user))

in this step we added the trim function which takes out any whites spaces - which are used to launch SQL Injection attacks

You can see more about this here

edited May 23, 2017 at 10:34

CommunityBot

11 silver badge

answered Aug 15, 2012 at 21:36

pzirkind

2,3382 gold badges21 silver badges25 bronze badges

Comments

Anonymous · Accepted Answer · 2012-08-16 00:28:55Z

0

Alternatively you can convert it to binary:

function mssql_escape($data) {
    if(is_numeric($data))
        return $data;
    $unpacked = unpack('H*hex', $data);
    return '0x' . $unpacked['hex'];
}

... If in case you are not on mysql db.

answered Aug 16, 2012 at 0:28

Anonymous

4,63110 gold badges66 silver badges99 bronze badges

Collectives™ on Stack Overflow

prevent sql injection by converting string to arrays

3 Answers 3

7 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

7 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related