Question

I saw several examples and people using this way to query the database in a login form.
I’m not fully sure is this is the best way to do a login form secure.

This is the query in PHP:

    $query = "SELECT * FROM users WHERE usern = '".$_POST['username']."' AND passw = '".md5($_POST['password'])."'";

Is enough having md5() on the password post to avoid sql injection?.
I think that the md5 function will convert all characters and sql strings to a 32 char string.

Which other ways can I protect the login form?

Answer 1

mysql_real_escape_string($_POST['username']), etc.

Although it’s better to use the mysqli extension and use prepared statements.

(Assuming you’re using MySQL)

Edit: In response to the comment below, it might be good to use this for LIKE queries:

addcslashes(mysql_real_escape_string($_POST['username']), '%_')