note 102535 added to security.database.sql-injection

A good way to counter SQL injection for queries of type SELECT is use hash function on data by PHP and the database server. For example, it is possible to use the MySQL function MD5 () to produce a hash of data-server side , and the equivalent function in php web-server side. <?php $login = mysql_query("select f_uname, f_passwd from t_user where MD5(f_uname) = '".md5($uname)."' and MD5(f_passwd)='".md5($passwd)."'"); ?> Thus, the injected requests will be crushed and it will become much more difficult to obtain data in the database. Use both sides of the hash result in a comparison of hash, not the execution of the injected queries. Unfortunately, it probably does not work with other types of queries. ---- Server IP: 69.147.83.197 Probable Submitter: 207.96.205.12 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/102535 Del: integrated -- https://master.php.net/note/delete/102535/integrated Del: useless -- https://master.php.net/note/delete/102535/useless Del: bad code -- https://master.php.net/note/delete/102535/bad+code Del: spam -- https://master.php.net/note/delete/102535/spam Del: non-english -- https://master.php.net/note/delete/102535/non-english Del: in docs -- https://master.php.net/note/delete/102535/in+docs Del: other reasons-- https://master.php.net/note/delete/102535 Reject -- https://master.php.net/note/reject/102535 Search -- https://master.php.net/manage/user-notes.php