[Salorb]

Hey HF, I was wondering if someone could help me. I am currently working on a website for myself and I need a secure login page. Can anyone help? Thanks.

[B0$$]

are u looking for pro coder or a php coder ?

[Salorb]

I mean I need a php coder who can code it from start to finish. Thanks

[Sir Asylum]

To Secure the login page, you can add filters like
mysql_real_escape_string and stripslashes

Dont give the newbies bad examples.
Tell them to use PDO or Mysql(i) instead.

[thegentlad22]

Please do not ever post in this forum until you've educated yourself.

OP, never ever use mysql_* or stripslashes. Just use PDO.

What's wrong with mysql ? why called the lad a uneducated person?

PDO = let others do the work for you the lazy way. using mysql = getting an education to what's the problem and why it's unsecured... which forces you to deal with the problem.

PDO has it's issues and there's are minor security holes can can result using it if you don't know how to filter inputs on your own.

However, OP just either learn how to use mysqli or PDO mysql itself is on it's dead bed.

I use 100% mysql but written my own functions to filter inputs and secure everything. I written my one monitoring system that tracts what each member is doing on my website. It compares their actions with my own defined patterns that detect a hacking attempt. I then lock them out once detected.

However, MYSQL is old you need to use MYSQLi which is the updated version and soon MYSQL will be obsolete. .

I did my own route because I knew PHP before it was common knowledge about SQL injections. Once it was common knowledge they took about 2 or 3 years to come up with mysqli and PDO. However, I was at the time writing my own website. I then had to find a quick solution. However, eventually since right now I am just doing finishing touches on my website. I will go back and rewrite my code using PDO.

I pick PDO because I am told it's universal with other database. I am using that just in case if I ever need to switch and use some other database for any reason.

[thegentlad22]

There's not that much to learn from the old MySQL API. Basically "If you stick unfiltered variables in a query, the query can be manipulated in unexpected ways". Use prepared statements instead, and it will make sure that nothing bad from the input enters the actual query.

$mysqli = new mysqli('localhost', 'root', '', 'mydatabase');
$stmt = $mysqli->prepare('INSERT INTO users (name, age) VALUES (?, ?)');
$stmt->bind_param('si', $_GET['name'], $_GET['age']);
$stmt->execute();

is more secure than

mysql_connect('localhost', 'root', '');
mysql_select_db('mydatabase');
mysql_query('INSERT INTO users (name, age) VALUES ('.$_GET['name'].', '.$_GET['age'].')');

Ya I know but for me switching to PDO isn't because of the security holes. I never had any issues with my own solutions. The point is to filter all inputs. You need to restrict inputs to either numbers or a string that has no code. The more strict you're on your inputs the more secure it will be. However, the reason I am switching over is becasue PHP newer versions will drop support for MYSQL. it will solely used mysqli but I am told that they will ditch mysqli because it's not as good as PDO. I was told by 2020 they plan to ditch mysqli but it's not written in stone.

So, If I have to rewrite my code I would rather use whatever that will be standard for a long time. However, my point if you use MYSQL you can filter the inputs yourself and it gives you a good way to education yourself from the problems. That way if you in years from now decided to writer your own shit or write a programming language etc. You will learn from the teams PHP mistakes. I am saying to become a better programmer it's always good to learn others mistakes and how they overcome that problem. So, you never make those same mistakes in your life.

The main mistake in mysql was allowing SQL query code to run. People would directly insert the inputs to the query function. This resulted to execute sql code. which if a hacker knows his stuff can manipulate the query string and insert their own code. This is where they now tell you always filter your inputs because you can never trust people from the internet anymore.

Still I rather see OP learn the problems and issues and how PHP made the improvements rather then just tell him go use MYSQLI or PDO and never think about why we need it other then it's secure and it's about security. Then you will use these tools ignorantly because you never had the interest to learn.

I just think if your'e going to code or learn how to code you better learn it right and learn what common mistakes programmers make and try to eliminate those mistakes when you're coding. That was my attitude towards learning programming when i learned PHP and been using it for 6 years.

[thegentlad22]

I thought we were done explaining why using PDO or MySqli over native mysql functions is better.

---

Learning PDO and MySqli would be learning it right, why would you learn the old stuff when you can learn the new stuff? Sure he might learn why PDO is better over the old mysql api, but there is no need for that as he is just starting. All he needs are the basics.

I am saying that telling someone about it and telling him it's wrong and giving reasons. People absorb the knowledge in a 2D format. They will remember it as a set of rules rather then becoming part of their logic. Education equals gaining now logic and training equals set of instructions.

It's fine for now for him to use PDO or MYSQLi but I just want him at a later time to take the time and learn about the security holes that MYSQL had.

There's a big difference between you telling me that this is bad and isn't standard to me reading about it and doing a lab about it. It's testing and making sure you fully understand the concept and logic about the matter.

Learning this will get you to learn how to write your own PDO or MYSQLi. I am saying if you fully understand the problem and issue at hand and how the PHP team solved the problem. It adds on logic to your brain. You can avoid any problems or issues in the future.

I am saying what if 5 or 10 years from now you get bored with writing apps and software and you decided to write your own programming language. Learning this will help you understand a little more about security and vulnerabilities in all aspects in programming. It don't matter if you're programming your server for a website or you're making an app for your computer or an app for a cellphone. Or making your own electronic hardware. Knowing these concepts right now will make you a better programmer and make you write clean secure code. As long you understood the fundamentals.

If you think just because HF members on here told you that you shouldn't do this and it's because it's bad. You won't fully understand why and therefor you will always follow that advice like if it's the bible. So, whenever you code you will follow those exact instructions. However, what if a new flaw comes later on which this same advice is no longer secure. Someone found a flaw with this advise. Or what if the advice no longer is valid and in then next 10 years you end up having additional things more after finding out some more flaws.

I am just saying if you want to learn something properly and right. You go on all out. That is why I learned about it and wrote my own functions to deal with the problem and issue.

Also if you want to insert code like SQL queries. You still filter them. You don't let SQL language constructs stored in the database instead replace them with something else. So when grabbing it from the database you can reconstruct the query code and just out it in html. The logic you should be looking at is what can someone do to input code that will run.

If you fully understood the issue you would't be asking me such a question. The core logic to this issue is what if someone inputs code. How can I filter that input to not allow it to run as code but instead store it as text. So, no matter what is thrown at your server it won't run as code. That is what this is all about. Key word always filter inputs so no code can run from the inputs.

Once you understand the problem and issue fully and understand the solutions. You may never use this in your life but it makes you a better programmer. If for some reason at some point in your life you might want to write your own programming language or make or create your own electronic device. The logic is the same or maybe you want to be a hacker. You will have to think in the same way how can I bypass the protections of a server, of a electronic device of a program. This is the fundamental concepts in protecting your programs or websites from being hacked or tampered with results that wasn't designed by you or allowed.

So, it will help you in all aspects in programming but not just in programming you can use this knowledge also in engineering. If you want to engineer anything to secure objects or add security to a device. You will have to think the same way which is how would someone get unauthorized access to what you don't want anybody to have access to it.

So, learning this will help you as a programmer. However, You still need to use MYSQi or PDO because PHP is going to use these two and will no longer support MYSQL.

So, I am saying he can use MYSQLi or PDO for now but should learn when he gets a chance to do some labs and play around with SQL injections.

I learned what I know from actually doing the labs. I knew it wasn't something you should do but at the time I learned about it was when everyone just found out about SQL injections. The PHP team went to work for a solution. While they did that I read articles about it and then done projects to learn about it. I then created my own solutions before the PHP rolled out MYSQLi and PDO.

Doing my own labs and rolling out my own solution made me become a better programmer. Since I understood the issues at hand. If I just sat and wait for the PHP team to come up with a solution which most ended up doing. I would't know exactly what they did to solve this solution.

I am just saying as programmers you will have these issues at some point in your life again maybe not exactly SQL injections but think about other types of code that could run from your inputs. the PHP team made a fundamental mistake. Why should you ever make such mistakes?

I am just letting OP know to be a better programmer you always need to know what are the problems programmers faced and what was the solution to those problems. Once you understand you will write more safer code and if you understood the logic of how we got to such a solution. You then can apply it to any project you have. If you don't understand the problem and the solution. Then if later down the road you have to write something yourself without using libs or others solutions you will make the same mistakes that the people that worked on PHP did. You also will lose respect from other programmers because you will look like a skid or someone at a low level. Yes, some may mock you for making such a mistake and it's not because they're mean. It's because they don't take you serious. If you're serious you will always look for better ways to write your code and better ways to secure it from possible hacks or getting results that you never intended your code should do.

👍

[thegentlad22]

Nice paragraphs, n00b.
The MySQL API is deprecated and will be removed soon. I assume whoever I replied to didn't know that because he told OP to learn how to use the API AND THEN switch to something better. inb4 "TH3N H3 KN0WS HOW 2 DEEL WIT HOW UNSAEF IT IZ AND WILL NO H0W TO FITLER INPUT".

MySQL_ = old and deprecated. Teaches users to use built-in functions instead of querying (mysql_create_db). Teaches/forces users to filter input, which is often done badly which does more harm (removes special characters out of usernames and passwords) than good.
PDO = proper way to nullify any SQLi attempts based on education and empirical evidence. And it's object-oriented, so you can build on/over it with ease.

I am not a noob. I already know MYSQL is going to be depreciated. Hint that is why I am converting to use PDO. However, I at least know how to create solutions for myself rather then have someone else solve them for me.

You don't have be to an ass about this. Telling him to simply just use PDO and never understand the problems at hand how how they created PDO in teh first place makes them weak as a programmer. The will never know exactly how to come to a solution to these problems. If everyone encourages every programmer and software developers in the world to do this. Then we will never have a solution in the future. We will repeat history and make the same mistakes again.

[Sir Asylum]

I am not a noob. I already know MYSQL is going to be depreciated. Hint that is why I am converting to use PDO. However, I at least know how to create solutions for myself rather then have someone else solve them for me.

You don't have be to an ass about this. Telling him to simply just use PDO and never understand the problems at hand how how they created PDO in teh first place makes them weak as a programmer. The will never know exactly how to come to a solution to these problems. If everyone encourages every programmer and software developers in the world to do this. Then we will never have a solution in the future. We will repeat history and make the same mistakes again.

You should have converted to PDO half a year ago already.
You are behind sir and that means that you do not read all the updates on php.net Thus that makes you a bad developer.