Re:PHP MD5 Secure login script.
by infinity on Friday October 07, 2011 @01:40PM
(#3084986)
In the verifier.php I see a problem here:
$uid=$_COOKIE['uid'];
$uname=$_COOKIE['uname'];
$sql="SELECT * FROM users WHERE username='$uname'";
The $uname is set from the value of 'uname' in the $_COOKIE array, but I see no input validation here.
If I were an evil attacker, I could send arbitrary cookie data to the server, it would end up in the $_COOKIE superglobal. If I include some SQL code, ... All input is evil!
Later, in the welcome.php the $_COOKIE['uname'] is echoed without any escapes.
Re:PHP MD5 Secure login script.
by maratd on Monday October 10, 2011 @06:33PM
(#3096170)
> I see a problem here:
No, that's not a problem. It's a disaster. Whoever wrote that should be shot. If you're going to stick things from a cookie into your database, at least have enough brains to use a prepared statement.
Re:PHP MD5 Secure login script.
by gregjor on Friday October 07, 2011 @02:03PM
(#3085116)
Use mysql_real_escape_string() instead of addslashes(). And the cookie contents can't be trusted. The usual way to do this is with a server-side session, but if a cookie is used the user id and name have to be protected; MD5 can be used to do that, too.
Re:PHP MD5 Secure login script.
by _ud4a on Friday October 07, 2011 @01:16PM
(#3084902)
why are you adding slashes to the password before converting it into md5? even if they have ' in the password the md5 would get rid of it when you use it in the query.
If I were an evil attacker, I could send arbitrary cookie data to the server, it would end up in the $_COOKIE superglobal. If I include some SQL code, ... All input is evil!
Later, in the welcome.php the $_COOKIE['uname'] is echoed without any escapes.
No, that's not a problem. It's a disaster. Whoever wrote that should be shot. If you're going to stick things from a cookie into your database, at least have enough brains to use a prepared statement.