MD5 Securing SQL Injections

So I was perusing google looking for PHP/MySQL anti-SQL injection scripts/tutorials and I came across a script where the author showed a script that would be "insanely secure" one of the things that he did was MD5 the uname and pword. That was all he did as far as filtering for user input.

The first comment, which sparked a large discussion, was that it was open to SQL injections. There was a lot of arguing as to whether or not it was free from SQL injections, but no one ever really concreted their case. Since no one would test it.

I haven't had a chance to set up anything to test this, but does anyone know from experience whether or not using the MD5 PHP function can stop a SQL injection? I am aware that MD5 is deprecated and not as secure as it once was, I have been able to google a few hashes myself and get the actual plain text, but I am still wondering if it would stop SQL injections.

Thanks,

Slart

In short, no it won't.

Somewhat longer version, input validation! Don't trust anything a clients sends you.

Yup thats the number one rule :-)

That is what the author was saying, that by using MD5() on the username and password, that it was doing the filtering, which is why there could be no SQL injection. Which is what started the argument.

But is that a valid way to filter? I don't know if it sounds kosher to me, but it seems that encrypting the username and password fields would actually work, I don't know. He didn't use any other kind of filtering.

A linky to the original article might be useful. As he might have a point but without knowing what else is inputted there's no way to tell if it's enough..

Quote:

---

Originally Posted by Slartarama

That is what the author was saying, that by using MD5() on the username and password, that it was doing the filtering, which is why there could be no SQL injection.

---

Wrong.

Quote:

---

I don't know if it sounds kosher to me, but it seems that encrypting the username and password fields would actually work, I don't know.

---

Unless you add your own salt...

All its going to do is slow people down from one defacement per thirty seconds to one defacement every thirty minutes. At that point, either way you've got little pink kittens dancing on your homepage.

Yeah, sorry I should have posted the link originally, here it is:

http://insanesecurity.wordpress.com/...-login-script/

Oh yea that's secure - NOT!!!

http://antionline.com/showthread.php...012#post937012

Quote:

---

Originally Posted by dinowuff

Oh yea that's secure - NOT!!!

http://antionline.com/showthread.php...012#post937012

---

To much effort to read and learn, i prefer to just be able to point 'N click. I'll just load up my super dooper skript kiddie app with 101 l337 h4x0'r tools and do a super doooper kewl SQL injection. :george:

okay please forgive me, I read the SQL injection post, I am still lost. After reading this guy's script, I agreed with the first response that this is still open to SQL injection but I don't exactly follow why.

Something is just not right, a lot of people think in that post that the MD5() of the username makes it safe. I wrote a few PHP logins in my time but that was years ago I always used the filtering functions to filter user input and MD5 for the passwords. I'm sure if I looked back they would be out of date or heaven for fend I might have sites out there that are not really secure. I'm a rank amateur and I am very rusty.

So I know that MD5() (as dated as it is) encrypts the input in this case, but what exactly makes it open to injection? I have a feeling that it is wide open, especially judging from the original author's "teenage ranting" and the first response is from someone that seems to know what is going on, but well, it just seems off, so can someone explain it to me, I see that it would make an MD5 hash out of the injection if inputed, but would SQL see it as an MD5 hash or as "'OR 1=1-- " even though it is encrypted. Anyway that's where I am lost.

Thanks
Slart

Posting a username like

a' OR 1=1;

Short circuits the whole deal... The SQL statement will become:

SELECT r34ln4m3 FROM 1nside0ut WHERE
md5(l0gn4m3)=’a’ OR 1=1; AND entryw41=’$passwd’;

If he'd done something like:

$username = md5($_POST["username"]);
$passwd = md5($_POST["passwd"]);

$md5_un=calc_md5($username);
$md5_pw=calc_md5($password);

$query = “SELECT r34ln4m3 FROM 1nside0ut WHERE
l0gn4m3=’$md5_un’ AND entryw41=’$md5_pw’”;

That would have protected him... Unfortunately the guy's rather clueless..

Got it! Thanks, that's what I was missing. Now I see how it breaks it.

I did a quick google of calc_md5, nothing really official comes up, is it built in? I see a PHP function named that that someone wrote, but I am not familiar with it,

thanks

No, it's just something I used as an example. The idea is that it's a function that can read an arbitrary string and return it's MD5 hash.

yeah, before everyone assumes it's the database md5 function, see original article using md5() before sending to the db:

Code:

---

<?php

$username = md5($_POST["username"]);
$passwd = md5($_POST["passwd"]);

$handle = mysql_connect(”user”,”pass”,”mySQLHost”);
      mysql_select_db(”yourdb”);
$query = “SELECT r34ln4m3 FROM 1nside0ut WHERE
      md5(l0gn4m3)=’$username’ AND entryw41=’$passwd’”;

$result = mysql_query($query, $handle);

if (mysql_num_rows($result)!=0) {
      //mark as valid user
      header(”Location: private.php”);
      exit;
}

//if the code reaches this part then the login failed
//wrong username/password

header(”Location: public.php”);

?>

---

As for the rest of the code... ack.... but whatever.

Another mistake in the code is the fact that he doesn't check how many results he got.
Besides checking for no results (incorrect username/password), you obviously can only have ONE unique username too.

Therefor the query should result in ONE (!) row, anything more and some thing's fishy.

omg... there has been so much debate/arguing since I wrote this script... for what, for nothing...

@SirDice: yes I'm clueless concerning the fact that so many people keep saying that the script is vulnerable... although as the PoC code that it is, nobody can prove that...

I mean, the entire input is md5ed; here let me compress the entire script into one single line, assuming that when you (and everybody else) see the entire line you will argue no more on its effectiveness (no other word came to mind).

Code:

---

$result = mysql_query(
    "SELECT r34ln4m3 FROM 1nside0ut WHERE md5(l0gn4m3)='"
    .md5($_POST['username']).
    " AND entryw41='"
    .md5($_POST['password']). "'",

    $handle
);

---

ok so there are more than one line, but compacted the code so that it would be easier to understand (don't know why people won't understand the original code)...

now for those of you which want to see the working "internals".

a' OR 1=1; = 6ec741675c969f8c9a355f144c7b0c47

if you can conceive this result, than you realize that the query won't be

Code:

---

SELECT r34ln4m3 FROM 1nside0ut WHERE
md5(l0gn4m3)=’a’ OR 1=1; AND entryw41=’$passwd’;

---

but instead it will be

Code:

---

SELECT r34ln4m3 FROM 1nside0ut WHERE
md5(l0gn4m3)=’6ec741675c969f8c9a355f144c7b0c47' AND entryw41=’d41d8cd98f00b204e9800998ecf8427e’

---

an empty password will generate the above password hash...

hope that now everybody's got the picture...

by the way, sql injection don't end with ; ... you either user # or /*...

cheers

Quote:

---

Originally Posted by just_visiting

Code:

---

$result = mysql_query(
    "SELECT r34ln4m3 FROM 1nside0ut WHERE md5(l0gn4m3)='"
    .md5($_POST['username']).
    " AND entryw41='"
    .md5($_POST['password']). "'",

    $handle
);

---

---

This is secure and I hadn't looked close enough at your original source. It does protect you from SQL injection. The only snag I see now is that this query is a rather big load on the SQL server, especially if the table is large. As for each entry in the table it would need to calculate MD5 hashes. So you're better off storing the username/passwords as MD5 hashes instead of calculating them on the fly.

A much simpler approach is to use placeholders, prepare and execute.

$query="SELECT * FROM 1nside0ut where l0gn4m3=? and entryw41=?";
$sth=$dbh->prepare($query);
$sth->execute($username, $password);

Also, don't forget to check if you get more then 1 (one) row ;)

It is true. Support you.

Quote:

---

Originally Posted by just_visiting

by the way, sql injection don't end with ; ... you either user # or /*...

---

Didn't see this one up until now. A ; indicates the end of a query in MySQL. It doesn't really matter if what comes after it is syntactically correct or not, it'll still processes the first query (before the ; ). You'd use remarks to cull any syntax errors but since they don't matter anyway why bother?