Question

When a user registers I clean the password with mysql_real_escape_string as follow

$password = clean($_POST['password']); 

Before adding it into database I use :

$hashedpassword = sha1('abcdef'.$password);

and save it into mySQL.

My question is should I clean it or am I protected that the password is hashed before adding it into the DB ?

Answer 1

Well, there is one major misunderstanding.

mysql_real_escape_string() does not clean anything. It has nothing to do with security at all.

This function is used just to escape delimiters and nothing more. It can help you to put string data into SQL query – that’s all.

So, every string you’re going to put into query (by putting it in quotes), you have to prepare it with this function. In all other cases it would be useless or even harmful.

Thus,
out of this misunderstanding, you’re doing 2 major mistakes here:

• you’re using this function not with data that’s actually going to the query
• you can spoil your password by adding some symbols to it, so, it become unusable

Also, as a side note, please bear in mind that this function should be always used in conjunction with mysql_set_charset, or otherwise a "_real_" part of this function become useless