-- is a comment delimiter in SQL, keeps the last single-quote from causing ASP or the SQL parser from returning a syntax error.
For the most part, I'd guess that the hardening techniques presented in that article could be applied to PHP as well. I mean, really, both languages interact with HTML in similiar ways, though they have different built-in method to do it. Regardless, it's still POST or GET key/value pairs. If the key is passwd, you can manipulate the value.
The way I handle this in whatever language (I've done CF, PHP and ASP authentication schemes) is to never include a password argument in the WHERE clause. Ask the database about the username (which is, of course a unique index), then in your code, examine the passwords. If they put in some garbage for the username, the database will return an empty array (or recordset, or whatever it returns on your system). Also, remember, you're only looking for one record, after all, so there is no reason to loop through the returns.
.c
*EDIT:
Let me clarify what I mean by "Ask the database about the username" a little bit:
You might use, for example:
$sql = "SELECT uid,username,passwd FROM users WHERE username='carnix';";
...
if($db_password == $html_password){ return true; }
- $sql = "SELECT uid,username,passwd FROM users WHERE username='carnix';";
- ...
- if($db_password == $html_password){ return true; }
That's a very stipped down version, of course, but you get the picture, I think.
May 18th, 2004, 5:25 am
