filter_input as an alternative for mysql_escape_string for security?

PHP
1

I’ve not used or come across the filter_input() function, as my server’s still using 5.1. I can across this code in a task I set an applicant. He’s filtered the input but not escaped it. It seems to me to be insecure, but I’ve not managed to come up with an input that would exploit it.


$username = trim(filter_input(INPUT_POST,'username', FILTER_SANITIZE_STRING));
  $password = trim(filter_input(INPUT_POST,'password', FILTER_SANITIZE_STRING));

  // Check database to see if username/password exist.
  $x = sha1($password);                  // encrypt password
    $found_user = $mysqli->query("SELECT * FROM users
                                       WHERE username = '{$username}' and password = '{$x}' ");

Is it insecure? I would have thought it best to escape everything!

2

Yes it is insecure. Filter is not a replacement for the databases’ own escaping methods.
Also note, it is pointless running password though filter and escaping functions.

3

Do you mean it’s pointless to do both? ie if you’ve filtered then you can be sure there’s nothing to escape?

Can you illustrate this with an example that would break the code above? If I pull this applicant up on his security it would be good for me to exemplify this vulnerability. I’ve tried the following

' OR '1'='1

which didn’t break it. I can’t think what else to use.

4

I mean, when you run the password though a hash like sha1 there is nothing to filter or escape. Filtering and escaping changes the password the user submitted, I advise to never change the password a user submits.

Can you illustrate this with an example…

No at the moment, running though programming exercises I don’t currently have time for at the moment.

5

That’s fine. It’s an open forum, so anyone can chime in. :slight_smile: