PHP Log In form & SQL Injection attacks

[Irene9001]

Hi

There is major concern issue disturbing me when I create a php log in form to my website. There are few SQL Injection methods regularly used by hackers to by pass the admin security. I am curious to know how to secure log in form to prevent hackers?

[Rozanne]

You should use below functionality

mysql_real_escape_string();

$sql = "select * from table where id = mysql_real_escape_string($id)";

[LogenWilson]

Rather than just passing the function without escaping the dangerous characters. I'd recommend you to code your own functionality. This is not only assist you to get off the user input, but also helps you to find when someone is trying to by pass log in form security. You can set an output message to the user when anyone tries to do SQL injection.

[SandraJose]

You can also apply these validation rules in all of your code. Generally it know as input validation and any hacking attacks that occurs via forms should be prevented.

[LindyTaylor]

Even though, if your form consists of radio buttons, check boxes, drop down lists, then hacker still have many chances to invent back doors, as once they find form inputs in HTML source.

[Kristine Habeck]

According to my experience if hacker fails in sql injection, then hacker will looking at for another options to get in. You need to include a block feature to your log in form so if someone does try sql injection script, add the IP to the database and block them. Perhaps blocking IP is not the full proof solution, but it does prevent few imbeciles hackers.

[Michelle Taylor]

In my opinion the most reliable method is database framework with prepared statements. All of your variables will pass individually from the sql, so they can be properly escaped and will saves many keystrokes.

[morean51]

Originally Posted by Taylor31

In my opinion the most reliable method is database framework with prepared statements. All of your variables will pass individually from the sql, so they can be properly escaped and will saves many keystrokes.

this is preferable way i was using