Fix PHP MySQL injection for login

Question

I have a PHP script that signs a user into my site when they enter the correct login credentials. However, I noticed that it is easy to inject this login by entering anything' OR 'x'='x into the password box.

How can I stop this from happening?

$query = "SELECT * FROM sm_editors WHERE email = '".$_POST['email']."' AND password = '".$_POST['password']."' AND user_type != 'reader-for-approval'";

possible duplicate of [How to prevent SQL injection in PHP?](http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php) — DCoder, Feb 23 '13 at 13:29
How are we supposed to know which part is confusing you? Ask specific questions. — Barmar, Feb 23 '13 at 13:31

score 2 · Answer 1 · edited May 23 '17 at 12:27

2

You first need to sanitize the inputs to prevent this.

The function mysql_real_escape_string will remove any escape characters.

Take a look at What's the best method for sanitizing user input with PHP? question for more information.

edited May 23 '17 at 12:27

Community

1
1

answered Feb 23 '13 at 13:31

John Wheal

9,908
6
29
39

score 0 · Answer 2 · answered Feb 23 '13 at 13:30

0

You can use mysql_real_escape_string function on data you pass to your query or use prepared statements and stored procedures instead of old syntax.

answered Feb 23 '13 at 13:30

Xazzzi

83
7

score 0 · Accepted Answer · answered Feb 23 '13 at 13:33

0

$query = "SELECT * FROM sm_editors WHERE email = '".mysql_real_escape_string($_POST['email'])."' AND password = '".mysql_real_escape_string($_POST['password'])."' AND user_type != 'reader-for-approval'";

answered Feb 23 '13 at 13:33

Sash

4,448
1
17
31

score 0 · Answer 4 · answered Feb 23 '13 at 13:37

first you can use mysql_real_escape_string to escape the string.

But a better way would be, when you would prepare your SQL string before you execute it. Have a look at PHP PDO MySQL connector. There you have some methods to prepare your string.

$s = $pdo->prepare('SELECT * FROM table WHERE field1 = :value');
$s->execute(array(':value' => $value));

hava a look at http://www.php.net/manual/de/pdo.prepared-statements.php

Fix PHP MySQL injection for login

4 Answers4