7
\$\begingroup\$

I have run into a bit of a dilemma. Binding user input and building a prepared statement is all well and good, but what if I need the user input as a variable for a compare?

Can I just create a function to clean the input?

This is the line that worries me:

$password = $_POST['password']

What I have working so far:

// QUERY
public function query($query){
    $this->stmt = $this->dbh->prepare($query);
}

// RESULT SET
public function resultset(){
$this->execute();
    return $this->stmt->fetchAll(PDO::FETCH_ASSOC);
}

// EXECUTE
public function execute(){
    return $this->stmt->execute();
}

Check that the password matches with the database password if username exists

<?php
if (isset($_POST['login'])) {

    $dbpass = '';
    $password = $_POST['password'];

    //Select username, password, salt and active
    $database->query('SELECT username, password, salt, active FROM wcx_admin WHERE username = :username');

    $database->bind(':username', $_POST['username']);

    $rows = $database->resultset();

    if(isset($rows[0])) {
        $salt = $rows[0]['salt'];
        $dbpass = $rows[0]['password'];
        $password = hash("sha512", $password . $salt);
    }
    if($password !== $dbpass) {
        echo 'Incorrect Username or Password';
    } 
}

?>

Binding Function

// BIND
public function bind($param, $value, $type = null){
if (is_null($type)) {
    switch (true) {
        case is_int($value):
            $type = PDO::PARAM_INT;
            break;
        case is_bool($value):
            $type = PDO::PARAM_BOOL;
            break;
        case is_null($value):
            $type = PDO::PARAM_NULL;
            break;
        default:
            $type = PDO::PARAM_STR;
    }
}
$this->stmt->bindValue($param, $value, $type);
}
\$\endgroup\$
  • 4
    \$\begingroup\$ php.net/manual/en/function.password-hash.php \$\endgroup\$ – PeeHaa Jun 28 '14 at 12:56
  • \$\begingroup\$ Can you explain why you feel i should read that? \$\endgroup\$ – CodeX Jun 28 '14 at 12:57
  • 1
    \$\begingroup\$ Because it will prevent you from screwing up password hashing. \$\endgroup\$ – PeeHaa Jun 28 '14 at 12:58
  • \$\begingroup\$ So this $password = hash("sha512", $password . $salt); is wrong? it should be password_hash("sha512", $password . $salt); ? \$\endgroup\$ – CodeX Jun 28 '14 at 13:00
  • 3
    \$\begingroup\$ Thankyou, its so much easier with password_hash() and password_verify() i can get rid of salt now too! \$\endgroup\$ – CodeX Jun 28 '14 at 13:36
2
\$\begingroup\$

You should also make heavy use of the filter functions of PHP.

<?php

if (filter_input(INPUT_POST, "form_id", FILTER_UNSAFE_RAW) === filter_input(INPUT_SESSION, "form_id", FILTER_UNSAFE_RAW)) {
  $username = filter_input(INPUT_POST, "username", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);
  $password = filter_input(INPUT_POST, "password", FILTER_UNSAFE_RAW);

  if ($username && $password) {
    $database->query("SELECT `username`, `password`, `active` FROM `admin` WHERE `username` = :username AND `password` = :password LIMIT 1");
    $database->bind(":username", $username);
    $result = $database->resultset();

    if (isset($result[0]) && password_verify($password, $result[0]["password"])) {
      echo "Welcome!";
    }
  }
}
\$\endgroup\$
  • 1
    \$\begingroup\$ Ive never seen these, ill check them out, thanks for the info! \$\endgroup\$ – CodeX Jul 4 '14 at 19:09
  • 1
    \$\begingroup\$ Note that I changed the INPUT_COOKIE to INPUT_POST. The form_id is used to protect your form from manipulation (CSRF). Usually not used for login forms, but I though I include it. \$\endgroup\$ – Fleshgrinder Jul 4 '14 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.