note 102535 added to security.database.sql-injection

A good way to counter SQL injection for queries of type SELECT is use hash function on data by PHP and the database server.
For example, it is possible to use the MySQL function MD5 () to produce a hash of data-server side , and the equivalent function in php web-server side.

<?php
$login = mysql_query("select f_uname, f_passwd from t_user where MD5(f_uname) = '".md5($uname)."' and MD5(f_passwd)='".md5($passwd)."'");
?>

Thus, the injected requests will be crushed and it will become much more difficult to obtain data in the database. Use both sides of the hash result in a comparison of hash, not the execution of the injected queries.

Unfortunately, it probably does not work with other types of queries.
----
Server IP: 69.147.83.197
Probable Submitter: 207.96.205.12
----
Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php
Edit        -- https://master.php.net/note/edit/102535
Del: integrated  -- https://master.php.net/note/delete/102535/integrated
Del: useless     -- https://master.php.net/note/delete/102535/useless
Del: bad code    -- https://master.php.net/note/delete/102535/bad+code
Del: spam        -- https://master.php.net/note/delete/102535/spam
Del: non-english -- https://master.php.net/note/delete/102535/non-english
Del: in docs     -- https://master.php.net/note/delete/102535/in+docs
Del: other reasons-- https://master.php.net/note/delete/102535
Reject      -- https://master.php.net/note/reject/102535
Search      -- https://master.php.net/manage/user-notes.php