Waraxe Forums

Lord_Vader · Regular user

We all know this code is vunarable for SQL injection:

waraxe · Site admin

This code by himself does not contain sql injection, because of the single quotes, surrounding input variables. Now, most of the real world php-enabled webservers are configured with "magic_quotes=on", so sql injection attempts will fail.
IF and only IF you encounter webserver with "magic_quotes=off", ten you can have sql injection case here, if there is no additional php code, responsible for input data sanitize.
In the last case you can try this username:

'OR 1=1 LIMIT 1/*

and let the password be whatever you want.
Then beause of the sql injection you will be loged on as first admin in table.
By the way, php pcode wants POST method, so you need manually crafted html file for exploiting.

P.S. I figured it out, that you asked question from webmaster's point of view, not from attacker's. So you want better code?
First of all, don't use plaintext passwords in database, better use salted md5 hashes.

Chb · Valuable expert

Secondary: Use mysql_real_escape_string() and maybe also addslashes() for escaping user input to prevent code.

Lord_Vader · Regular user

Ok, I get it. Thanks for the replies.
I use mysql_real_escape_string() for security.
@waraxe: Yes, I use MD5, but I only posted part of my code