goatella / simple-php-login Goto Github PK

The file login.php is vulnerable to two SQL injections:
if the user submits the login a' OR '1'='1' LIMIT 1,2# , he is able to connect as any user who uses a given password
if the user submits admin' AND password LIKE '0% , he is able based on the response to determine whether or not the admin password hash begins with 0, and eventually get the whole hash.

You claim to have 15 years experience yet you know nothing about SQL injection. I can't believe how shockingly bad your code is. I can't even log into my real GitHub account because I'm too ashamed to be drudging through such mediocrity.

mysql_query("SELECT * FROM members WHERE username = '".$_POST['username']."'")

Are you kidding me? You pass the $_POST variable straight into a mysql query? And you actually have the gall to call yourself a programmer?

You should seriously take this Github account down. This is so incredibly damaging to yourself and new developers who are just learning. I can't believe you're allowed to post on About.com, this makes it even worse that you have no clue what you're talking about.

You should not store passwords as plain text anywhere. This should be a pretty well known rule in 2017.
You should only ever store a (preferably encrypted) hash of the password, that way, if someone gets a hold of your database, they will not be able to easily obtain the passwords.

Please read the OWASP password storage guidance.