Escaping MySQL passwords necessary when md5 is used?
| From: | Dotan Cohen | Date: | Wed, 21 Sep 2011 17:53:03 +0000 |
| Subject: | Escaping MySQL passwords necessary when md5 is used? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-314969@lists.php.net to get a copy of this message | ||
I have an application in which the password is stored in the database
as md5(md5('passWord').'userSpecificSalt'). I'm checking the password
entered with:
$password=md5( md5('$_POST['password']').'userSpecificSalt' );
$query="SELECT id FROM table WHERE password='{$password}'";
Now I'm a bit queasy about not using mysql_real_escape_string() on
that $password variable! Please reassure me or tell me the folly of my
ways. Thanks!
--
Dotan Cohen
http://gibberish.co.il
http://what-is-what.com