# Login system, PDO and me

I have run into a bit of a dilemma. Binding user input and building a prepared statement is all well and good, but what if I need the user input as a variable for a compare?

Can I just create a function to clean the input?

This is the line that worries me:

$password =$_POST['password']


What I have working so far:

// QUERY
public function query($query){$this->stmt = $this->dbh->prepare($query);
}

// RESULT SET
public function resultset(){
$this->execute(); return$this->stmt->fetchAll(PDO::FETCH_ASSOC);
}

// EXECUTE
public function execute(){
return $this->stmt->execute(); }  Check that the password matches with the database password if username exists <?php if (isset($_POST['login'])) {

$dbpass = '';$password = $_POST['password']; //Select username, password, salt and active$database->query('SELECT username, password, salt, active FROM wcx_admin WHERE username = :username');

$database->bind(':username',$_POST['username']);

$rows =$database->resultset();

if(isset($rows[0])) {$salt = $rows[0]['salt'];$dbpass = $rows[0]['password'];$password = hash("sha512", $password .$salt);
}
if($password !==$dbpass) {
}
}

?>


Binding Function

// BIND
public function bind($param,$value, $type = null){ if (is_null($type)) {
switch (true) {
case is_int($value):$type = PDO::PARAM_INT;
break;
case is_bool($value):$type = PDO::PARAM_BOOL;
break;
case is_null($value):$type = PDO::PARAM_NULL;
break;
default:
$type = PDO::PARAM_STR; } }$this->stmt->bindValue($param,$value, $type); }  • php.net/manual/en/function.password-hash.php – PeeHaa Jun 28 '14 at 12:56 • Can you explain why you feel i should read that? – CodeX Jun 28 '14 at 12:57 • Because it will prevent you from screwing up password hashing. – PeeHaa Jun 28 '14 at 12:58 • So this $password = hash("sha512", $password .$salt); is wrong? it should be password_hash("sha512", $password .$salt); ? – CodeX Jun 28 '14 at 13:00
• Thankyou, its so much easier with password_hash() and password_verify() i can get rid of salt now too! – CodeX Jun 28 '14 at 13:36

You should also make heavy use of the filter functions of PHP.

<?php

if (filter_input(INPUT_POST, "form_id", FILTER_UNSAFE_RAW) === filter_input(INPUT_SESSION, "form_id", FILTER_UNSAFE_RAW)) {
$username = filter_input(INPUT_POST, "username", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);$password = filter_input(INPUT_POST, "password", FILTER_UNSAFE_RAW);

if ($username &&$password) {
$database->query("SELECT username, password, active FROM admin WHERE username = :username AND password = :password LIMIT 1");$database->bind(":username", $username);$result = $database->resultset(); if (isset($result[0]) && password_verify($password,$result[0]["password"])) {
echo "Welcome!";
}
}
}

• Ive never seen these, ill check them out, thanks for the info! – CodeX Jul 4 '14 at 19:09
• Note that I changed the INPUT_COOKIE to INPUT_POST. The form_id is used to protect your form from manipulation (CSRF). Usually not used for login forms, but I though I include it. – Fleshgrinder Jul 4 '14 at 19:11