7
\$\begingroup\$

I have run into a bit of a dilemma. Binding user input and building a prepared statement is all well and good, but what if I need the user input as a variable for a compare?

Can I just create a function to clean the input?

This is the line that worries me:

$password = $_POST['password']

What I have working so far:

// QUERY
public function query($query){
    $this->stmt = $this->dbh->prepare($query);
}

// RESULT SET
public function resultset(){
$this->execute();
    return $this->stmt->fetchAll(PDO::FETCH_ASSOC);
}

// EXECUTE
public function execute(){
    return $this->stmt->execute();
}

Check that the password matches with the database password if username exists

<?php
if (isset($_POST['login'])) {

    $dbpass = '';
    $password = $_POST['password'];

    //Select username, password, salt and active
    $database->query('SELECT username, password, salt, active FROM wcx_admin WHERE username = :username');

    $database->bind(':username', $_POST['username']);

    $rows = $database->resultset();

    if(isset($rows[0])) {
        $salt = $rows[0]['salt'];
        $dbpass = $rows[0]['password'];
        $password = hash("sha512", $password . $salt);
    }
    if($password !== $dbpass) {
        echo 'Incorrect Username or Password';
    } 
}

?>

Binding Function

// BIND
public function bind($param, $value, $type = null){
if (is_null($type)) {
    switch (true) {
        case is_int($value):
            $type = PDO::PARAM_INT;
            break;
        case is_bool($value):
            $type = PDO::PARAM_BOOL;
            break;
        case is_null($value):
            $type = PDO::PARAM_NULL;
            break;
        default:
            $type = PDO::PARAM_STR;
    }
}
$this->stmt->bindValue($param, $value, $type);
}
\$\endgroup\$
14
  • 4
    \$\begingroup\$ php.net/manual/en/function.password-hash.php \$\endgroup\$
    – PeeHaa
    Commented Jun 28, 2014 at 12:56
  • \$\begingroup\$ Can you explain why you feel i should read that? \$\endgroup\$
    – CodeX
    Commented Jun 28, 2014 at 12:57
  • 1
    \$\begingroup\$ Because it will prevent you from screwing up password hashing. \$\endgroup\$
    – PeeHaa
    Commented Jun 28, 2014 at 12:58
  • \$\begingroup\$ So this $password = hash("sha512", $password . $salt); is wrong? it should be password_hash("sha512", $password . $salt); ? \$\endgroup\$
    – CodeX
    Commented Jun 28, 2014 at 13:00
  • 3
    \$\begingroup\$ Thankyou, its so much easier with password_hash() and password_verify() i can get rid of salt now too! \$\endgroup\$
    – CodeX
    Commented Jun 28, 2014 at 13:36

1 Answer 1

2
\$\begingroup\$

You should also make heavy use of the filter functions of PHP.

<?php

if (filter_input(INPUT_POST, "form_id", FILTER_UNSAFE_RAW) === filter_input(INPUT_SESSION, "form_id", FILTER_UNSAFE_RAW)) {
  $username = filter_input(INPUT_POST, "username", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);
  $password = filter_input(INPUT_POST, "password", FILTER_UNSAFE_RAW);

  if ($username && $password) {
    $database->query("SELECT `username`, `password`, `active` FROM `admin` WHERE `username` = :username AND `password` = :password LIMIT 1");
    $database->bind(":username", $username);
    $result = $database->resultset();

    if (isset($result[0]) && password_verify($password, $result[0]["password"])) {
      echo "Welcome!";
    }
  }
}
\$\endgroup\$
2
  • 1
    \$\begingroup\$ Ive never seen these, ill check them out, thanks for the info! \$\endgroup\$
    – CodeX
    Commented Jul 4, 2014 at 19:09
  • 1
    \$\begingroup\$ Note that I changed the INPUT_COOKIE to INPUT_POST. The form_id is used to protect your form from manipulation (CSRF). Usually not used for login forms, but I though I include it. \$\endgroup\$ Commented Jul 4, 2014 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.