Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 343
  • Last Modified:

is my login script vulnerable to sql injection attacks, if yes, what should i do

session_start();

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($accesscheck)) {
  $GLOBALS['PrevUrl'] = $accesscheck;
  session_register('PrevUrl');
}

if (isset($_POST['user'])) {
  $loginUsername=$_POST['user'];
  $password=$_POST['password'];
  $MM_fldUserAuthorization = "";
  $MM_redirectLoginSuccess = "login.php";
  $MM_redirectLoginFailed = "login.php";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_mine, $mine);
 
  $LoginRS__query=sprintf("SELECT user_name, password, user_id, role, first_name, last_name, company_id, email FROM user WHERE user_name='%s' AND password='%s'",
    get_magic_quotes_gpc() ? $loginUsername : addslashes($loginUsername), get_magic_quotes_gpc() ? $password : addslashes($password));
   
  $LoginRS = mysql_query($LoginRS__query, $mine) or die(mysql_error());
  $row_LoginRS = mysql_fetch_assoc($LoginRS);
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {
     $loginStrGroup = "";
   
    //declare two session variables and assign them
    $GLOBALS['MM_Username'] = $loginUsername;
      $GLOBALS['user1'] = $row_LoginRS['user_id'];      
      $GLOBALS['level'] = $row_LoginRS['role'];
      $GLOBALS['name'] = $row_LoginRS['first_name'];      
      $GLOBALS['lname'] = $row_LoginRS['last_name'];
      $GLOBALS['comp'] = $row_LoginRS['company_id'];      
      $GLOBALS['email'] = $row_LoginRS['email'];
      $GLOBALS['MM_UserGroup'] = $loginStrGroup;           

//register the session variables
session_start();
session_register("MM_Username");
session_register('user1');      
session_register('level');
session_register('name');
session_register('lname');
session_register('comp');
session_register('email');
session_register("MM_UserGroup");
$valid_user = 1;

0
jblayney
Asked:
jblayney
  • 2
1 Solution
 
kylealanhaleCommented:
Well, you do add slashes, that's good.  The only other thing I would suggest would be to put anything (such as those username and password values) through quick regex check to make sure they only have the characters you want.  Something like
if (!preg_match('/[^\w\d!@#]{6,15}$/', $username)) die('Invalid username.');

Open in new window

0
 
kylealanhaleCommented:
Sorry, small typo; here's a (hopefully) bug free example.  Untested, but the principle is true.  By the way, this checks for a username between 6 and 15 characters long, either a letter or a number, or the character !, @, or #.
if (!preg_match('/^[a-zA-Z\d!@#]{6,15}$/', $username)) die('Invalid username.');

Open in new window

0
 
jblayneyAuthor Commented:
thank you
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now