Question

If I encrypt a MYSQL injection with md5, will it still execute? If I encrypt the MYSQL injection before I do the “mysql_real_escape_string” will it be able to null the mysql injection? Should I run the “mysql_real_escape_string” before I encrypt?

Answer 1

The md5() function returns a string containing the ASCII characters 0-9 and a-f. An SQL injection requires using characters like ' or ", thus a hashed string that was generated by md5() won’t cause an SQL injection EVER, considering that the algorithm works expectedly.

Thus you can write something like this without worry:

$username = mysql_real_escape_string( $_POST['username'] );
$password = md5( $_POST['password'] );
mysql_query("SELECT * FROM users WHERE user='$username' AND pass='$password'");

But it’s a good practice to always escape the data that you pass to your query with mysql_real_escape_string().