Does md5 stop SQL Injection

问题

Ok,

So, i'm a little unsure on this.

I have a url parameter username.

and I have this statement

SELECT * FROM users WHERE user_hash = md5($_GET['username'])

Is this secure?

Upon account creation an md5 hashed version of the username and the password are stored.

I'm confused as this seems so simple, if md5 stops sql injection why isn't username and password always saved in hash form?

回答1:

Yes, this will avoid SQL injection, because md5() always returns a string of hex code.

But it isn't a general solution to SQL-injection. You would have to encode almost all the data in your tables in MD5 format. For instance,

$sql = "UPDATE users SET fullname = '" . md5($_GET['fullname']) . "'
        WHERE id = '" . md5($_GET['id']) . "'";

But MD5 is a one-way hash, so there would be no way of displaying the full name that was stored this way.

回答2:

Short answer is no, MD5 does not prevent SQL injection. Proper coding is the best way to handle this.

Reason being in this case is that your query string parameter is allowing direct access to the sql. E.g. what if the user sends you:

?username=%27a%27);DROP%20TABLE%20users;%20--

That fakes the MD5 function out and drops the users table. Of course they have to know somethings about your database in order to do this. The correct way to handle it would be to MD5 the value before it went into the SQL. In PHP it would be something like this:

$username = $GET['username'];
$hashed_username = md5($username);
$sql = "SELECT * FROM users WHERE user_hash = '$hashed_username'"

Or the best solution would be to use bound variables in queries where you let the SQL libraries handle the translation. If you are using PHP, look into PDO bindParam, http://php.net/manual/en/pdostatement.bindparam.php

BTW, your SQL won't work because you would need to quote (') the get variable in the SQL.

回答3:

I'm confused as this seems so simple, if md5 stops sql injection why isn't username and password always saved in hash form?

The reason is because simple operations like searching for a user with a particular name would be impossible.

SELECT * FROM users where user LIKE '%cat%'

Would find all users with the word cat within it.

Also simple administration would be impossible, you can't even view a roster of all users.

来源：https://stackoverflow.com/questions/35025244/does-md5-stop-sql-injection

标签

php

md5

sql-injection