encrypt the data from SQL injections

Question

Please tell me how to correctly encrypt the data (username, email, message) sent to the server from sql injections. I can not understand the syntax of the record itself.

My php handler

session_start();

if (isset($_SESSION['captcha']) && $_SESSION['captcha']===$_POST['captcha']){
    if (isset($_POST['username']) && isset($_POST['email']) && isset($_POST['message'])){

        $username = $_POST['username'];
        $email = $_POST['email'];
        $message = $_POST['message'];

        $db_host = "localhost"; 
        $db_user = "alekspvn"; // Логин БД
        $db_password = "123"; // Пароль БД
        $db_table = "book"; // Имя Таблицы БД

    $connect_db=mysql_connect(HOST, MYSQL_USER, MYSQL_PASS)   
        or die("No connection with SQL"); 

        mysql_select_db("guests_db",$connect_db);

        mysql_query("SET NAMES 'utf8'",$connect_db);

        $result = mysql_query ("INSERT INTO ".$db_table." (username,email,message) VALUES ('$username','$email','$message')");
        echo json_encode(['success' => true, 'message' => 'Added to db']);
    } 
}
else { 
   echo json_encode(['error' => false, 'message' => 'Wrong captcha']);
}

I believe "SQL Injection" is typically used to refer to an attack involving executing undesired SQL code on a server. What do you mean by "SQL Injection"? — Cowthulhu, Oct 16 '17 at 18:39
You shouldn't use `mysql_*`, you should parameterize. `PDO` or `mysqli` allow for parameterized queries. — chris85, Oct 16 '17 at 18:40

Hack it · Answer 1 · 2017-10-16T18:54:34.560

1

Convert You Username and Password into password_hash to store

https://secure.php.net/manual/en/function.password-hash.php https://secure.php.net/manual/en/function.password-verify.php

edited Oct 16 '17 at 18:54

answered Oct 16 '17 at 18:47

Hack it

405
2
10

You should never use md5() on passwords. It is trivial to reverse. https://secure.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash – Ben Shoval Oct 16 '17 at 18:50
MD5 is not suitable for hashing passwords, PHP has a password hashing lib that is much better – JimL Oct 16 '17 at 18:51
@JimL Okk Fine I going to update – Hack it Oct 16 '17 at 18:53
1

There are no passwords being saved here. `username, email, message`. – chris85 Oct 16 '17 at 19:16

encrypt the data from SQL injections

1 Answers1