Avoiding SQL injection in PHP function

Question

Is this code susceptible to SQL injection?

function SaveUser($usu,$pass,$name){
    $sql="insert into usuarios(USU,PASS,NOMBRE,ESTADO)
    values('$usu',md5('$pass'),'$name','$apellido2','A')";

    ...
}

Answer 1

If you want to stop sql injection, the safest way is to not use sql. Although, PDO is the best option with prepared statements. I will leave an example of a connect/insert script. The documentation is at http://php.net/pdo. Also, you should use bcrypt or password_hash (only if you're on php 5.5) for hashing passwords. MD5 is not safe.

<?php
$connect = new PDO("mysql:host=localhost;dbname=db", "username", "password");
$connect->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING );
$query = $connect->prepare("insert into usuarios(USU,PASS,NOMBRE,ESTADO)
values(?, ?, ?, ?)");
$query->bindValue(1, $usu);
$query->bindValue(2, md5('$pass'));
$query->bindValue(3, $name);
$query->bindValue(4, $apellido2);
try {
     $query->execute();
} catch (PDOException $e) {
     die($e->getMessage());
}
?>

Answer 2

Yes it is, use pdo if you want to stop sql injection. Sanitization of the input data is really important before inserting into the database.

check this : How does PHP PDO's prepared statements prevent sql injection? What are other benefits of using PDO? Does using PDO reduce efficiency?

Here is the link on how to use pdo: http://www.php.net/manual/en/book.pdo.php

Answer 3

ANY time you're inserting dymamic data (e.g. variables) into an SQL query, the query becomes injectable. Even if those variables did not come from "outside" the system. You can TRIVIALLY inject yourself. e.g.

$name = "Miles O'Brien";
$sql = "SELECT * FROM users WHERE name='$name'";

Looks perfectly innocent. Theres no "external" data submitted by a malicious user. It's purely code + data you've written, but that '-quote in the name has now broken your statement and caused an injection attack. The attack fails because it's not actually a real attack, but it still introduces an SQL syntax error:

SELECT * FROM users WHERE name='Miles O'Brien';
                               ^^^^^^^^^---- string
                                        ^^^^^^--dangling unknown field/keyword.

Answer 4

Yes, the variables are not filtered before being inserted into the query, leaving the possibility of containing injection there. See How can I prevent SQL injection in PHP? for more information on how to prevent injection.

Aside from that, it seems like you're trying to use md5 as password encryption. I would recommend looking into other ways of hashing passwords, as md5 is not up to security standards.

Answer 5

Yes it is. You should look into Prepared statements
http://www.php.net/pdo.prepared-statements
The parameters to prepared statements don't need to be quoted; the driver automatically handles this. If an application exclusively uses prepared statements, the developer can be sure that no SQL injection will occur (however, if other portions of the query are being built up with unescaped input, SQL injection is still possible).

Answer 6

Yes, that statement is vulernable to an SQL Injection.

Also, you should NEVER use md5 to encrypt passwords. Use bcrypt instead

See here: How do you use bcrypt for hashing passwords in PHP?