1

I am making a login, and will use this for registration, and am allowing symbols and special characters in emails and passwords. I know that this poses a serious threat for hackers with injections. My question is: How might I turn the inputs from fields (ex. 'email', 'password'), into strings and not allow the server to process them as code and commands.

I truly have very little clue as to where to start, but have tried mysqli_escape_string; but, as you most likely know, it is very thin and deprecated. I don't mind researching a little, I would just greatly appreciate a bit of information to get started!

Improve this question
3
  • Take a look at PDO -- it makes it a lot easier to work with untrusted input like this. Commented Nov 27, 2014 at 3:17
  • @FoxWilson I agree PDO is better but mysqli supports prepared statements too. Has nothing to do with PDO specifically and PDO queries by themselves add no protection for user inputs. Commented Nov 27, 2014 at 3:19
  • Note I'm quite sure mysqli_escape_string (mysqli_real_escape_string) is not deprecated. Although mysql_real_escape_string is. Commented Nov 27, 2014 at 3:21

2 Answers 2

Reset to default
2

If you really do have no idea where to start, that's not a bad thing! However, I recommend not trying to go create you're own login/registration system unless you do know what to do. Especially if you care about security. This is an extremely easy thing to mess up, even for seasoned programmers. I will be the first to admit, I spent a lot of time rolling my own login/auth modules in PHP, and also spent a lot of time inheriting code where other people implemented their own method, most of the time, improperly.

I recommend learning a web framework. My favorite Web frameworks for PHP are Laravel, and Code Igniter, Laravel being my favorite. You'll find that you'll have a learning curve here as well, but you will find a lot more support for implementing user authentication correctly and securely. For exampe: http://laravel.com/docs/4.2/security

With a framework you could also get lots of helper methods to make DB access fun, easy, and safe. Check out the examples here! You can always use raw sql if you want!, but for your day-to-day CRUD applications, there is no need!

If you still absolutely insist on doing it yourself, though I will warn you against it one final time. I recommend using PDO or MySQLi prepared statements (I prefer PDO).

My guess is that the app isn't too far along since you're still considering how to build login/registration, so you're probably not "stuck" using raw php and doing it all yourself. :)

Improve this answer
Sign up to request clarification or add additional context in comments.

4 Comments

If you use a framework, make sure your framework is up to date. Because attackers are trying to exploit frameworks harder. They are more interested on them because if they find a vulnerability, they can exploit all the application which uses the framework..
Thank you very much for the input! This makes much more sense, actually. The only reason I am working on my own is because I want to be able to say it; but, after reading this, I may use a framework instead for now.
@plbsam is definitely correct about keeping your framework up-to-date. Fortunately they are regularly updated and far more tested than you'll probably care to do yourself when building your own secure auth system. But I assure you the advantage of ease-of-use and all the tooling makes it worth it. Tooling includes out-of-the-box functionality, pretty urls, db schema mgmt, models, views, controls, deploy scripts, templating, if you want fb/github/google login, there are efficient plugins for it, literally everything you need to build a web-app. When there isn't, you can always do it manually.:)
Also another major perk is that by knowing main-stream framework well, you can work much faster and build more projects. It also makes you more valuable as a web developer and more likely to be hired. For example, If I hire someone to do web work for me, I really really want/need it to be maintainable. That means I want it done in a common framework. It also increases your ability to do consulting by knowing the common frameworks that other companies/people use. You can also let other people do the heavy lifting of making a scalable/complete framework/updates. (and also help if you wish)
1
  1. Use prepared statements when executing mysql queries. (more details here)
  2. Limit input field length when possible (normally a mysql injection queries are long. This prevents execution of altered longer queries even there is a vulnerability made by a mistake)
  3. Give only the permissions needed for mysql users. Wherever you only need the user to read, provide only read permissions.
  4. Encrypt sensitive data like passwords. Use salted password hashing.
Improve this answer

7 Comments

Limiting a password to 10 characters isn't a very good practice.
Yep. I just wanted to describe what I meant by limiting input field length. I changed it. Thanks.
i would say don't put a limit to the input password field. More the number of possible permutations and combinations, the more difficult to crack it.
What is salted password hashing?
I would seriously caution on building your own login/auth system if you're completely new to it for anything other than a learning exercise. I do NOT recommend doing this for a production/client facing site.
|

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.