note 123597 deleted from mysqli.real-query by cmb
| From: | cmb@php.net | Date: | Sun, 10 Feb 2019 11:31:56 +0000 |
| Subject: | note 123597 deleted from mysqli.real-query by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-210223@lists.php.net to get a copy of this message | ||
Note Submitter: jay at cloudulus dot media
----
Well, we don't know if $password is in plain text because it was never defined in the example.
New passwords should be stored using
<?php
$crypt_pass = password_hash($password, PASSWORD_DEFAULT);
?>
Where PASSWORD_DEFAULT = BCRYPT algorithm
Then to compare a user entered password to a database stored password, we use:
<?php
$valid = password_verify($password, $crypt_pass);
?>
Which returns true or false.
As for being vulnerable to injection, this is true. To avoid this, use sprintf() or vsprintf() to
format the query and inject the values using mysqli::real_escape_string, like so:
<?php
$vals = [$db->real_escape_string($username), $db->real_escape_string($password)];
$query = vsprintf("Select * From users Where username='%s' And
password='%s'", $vals);
$result = $db->real_query($query);
?>