新聞財經娛樂♬資訊 News Economy

Today, I  review password requirement for my site register page. After understanding of
SQL injection matter, I doubt about what the requirement or validation password
in input password field for users before submitting the register form ?

Question-1
Do you think it is just let the requirement for password only with letters (upper or lowers cases or numbers) allowed that help to prevent any sql injection to mysql database
 completely, (for example, such as password as  '1' OR '1'='1' is not allowed) , Right ? Why I ask that , because I think if I am not allowing users or others
to input ' and '' or NULL or special characters to password requirement or validation on login page so that they are never able to do  any SQL injection, Right ?

Quesiton-2
If what I said on question-1 is correct, why not let our users to input any character they like for his password including character of ' and ''  if we can do hashing with md5() on those
password they input before running any mysql code in my register php page.

I mean hashing user passwords(any character they like) by md5() before submitting
to mysql database since the output of md5() is no any character of ' and " or NUL or
special character.

Anyway I guess that is not right, if right, why people suggest me to prevent SQL injection
by using PHP PDO or  mysqli instead of mysql, and use prepare and bind_param
statements

I read a lot of articles from search in EE for "SQL injection", but it is really
hard to read them all for solving SQL injection completely just for setting password
requirement only.


Please advise

Duncan  ( I was using mysql , NOW switch to mysqli and intend to use PHP PDO if need)

>>why it is bad,

It has already been mentioned several times:  If you use string concatenation to build executable code you open yourself up to issues.

Bind variables eliminate the threat.

>>>  why it is bad, the output of md5( "A634q!fh6")

that's because A634q!fh6 was typed in by a friendly user.

evil user types in something like this...


A");  --

So your sql statement is now...


update USER_TABLE set password =md5( "A");  --") WHERE userid =1234;

when you execute that, you just set every user's password to "A".

That's just one example.  You can get more creative.

I think you did not understood the answers :)

The thing is, if you use the bind variables approach, you will not need to worry about the password content anymore. It will accept ' or ''  1 passwords without leading to sql injections, because the query will not consider the ' and " as delimiters but will only consider them as values of the variable. Therefore, no SQL injection from those.