Question

I’ve done quite a bit of research and preparation with my code to try and prevent SQL injections, but I wanted to discuss something that I’m not quite sure about.

I understand the the mysqli_real_escape_string does not escape _ (underscore) and % (percent) characters. If I’m not using any LIKE clauses in my SQL statements, does this open me up to any risk?

Below is an example of one the instances I’m interested in talking about. Here is the login script I’m using. I want to make sure that I’m not opening myself up to any injection vulnerabilities here. Your insight and feedback would be greatly appreciated.

// Initiate login process if the mode is set to login
if ($_REQUEST['mode'] == "login") {

    // Open shared database connection
    $cxn = connectDb();

    // Escape characters to help prevent a SQL injection attack
    $username = mysqli_real_escape_string($cxn, $_POST['user']);

    // Convert submitted password to hashed value using 
    // custom password hashing function
    $password = custompwhash($_POST['pass']);

    // Execute SQL statement to determine if the credentials provided 
    // match a valid user
    $sql = "SELECT count(*) as countOK FROM user_def WHERE ".
            "username = '$username' AND password = '$password'";
    $result = mysqli_query($cxn,$sql);
    $row = mysqli_fetch_array($result);
    extract($row);

    // If the username value submitted is null, throw and error
    if ($username == "") {
        die2("Please enter your username and try again.<br />");
        failedloginalert($username);
    }

    // If the password value submitted is null, throw and error
    else if ($password == "") {
        die2("Please enter your password and try again.<br />");
        failedloginalert($username);
    }

    // If the credenetials provided match a valid user in the database, 
    // initate login
    else if ($countOK == '1') {    
        $sql2 = "INSERT INTO `user_activity` (`username`, `time`, `ip`)".
                " VALUES ('$username', NOW(), '{$_SERVER['REMOTE_ADDR']}')";
        $result2 = mysqli_query($cxn,$sql2);
        $_SESSION['auth'] = 1;
        $_SESSION['username'] = $username;

        // If the user does not need to be directed to a specific page, direct to home.php
        if (empty($_GET['page'])) {
            die2("<span style='color:#000;'>You have successfully logged in. <br /><br />
            Please click <a href=\"/admin/home.php\">here</a> if you are not automatically redirected.</span>
            <meta http-equiv='refresh' content='0;url=home.php'/>");
            die();
        }

        // Otherwise, if the user does need to be directed to a specific page, direct to the requested page
        else {
            $loginredirectpage = $_GET['page'];
            die2("<span style='color:#000;'>You have successfully logged in. <br /><br />
            Please click <a href=\"/admin/home.php\">here</a> if you are not automatically redirected.</span>
            <meta http-equiv='refresh' content='0;url=".$loginredirectpage."'/>");
            die();
        }
    }

    // Since the credenetials provided do not match a valid user in the database, throw an error
    else { 
        die2("The username or password you entered is invalid. Please try again. <br/><br/>If the problem persists, <a href=\"/user/resetpassword.php\" class=\"red\">reset your password</a>.");
        failedloginalert($username); 
    }
}

Answer 1

If I’m not using any LIKE clauses in
my SQL statements, does this open me
up to any risk?

No it doesn’t. = just gives you more exact answer than LIKE

SQL Injection is more to do with quote sign ' " since the technique tries to append on the query string. So I’d say % and _ won’t open up any security risk if you filtered all the possible quotes. In this case, mysqli_real_escape_string() can help.

PDO is an abstraction layer that assists you with dealing with databases more efficiently. It can help you with SQL injection, but I don’t recommend using it unless you’re building something big that requires a lot of interaction with database.

So final my point is your code looks ok (: