few php security questions

[Zaphan58]

First one in sql injection

I had this query

$query = "SELECT * FROM bootleg_admin WHERE name = '$username' AND  pass = '$password'";

After reading about sql injection I tried to use the escape string although I cant figure out whats wrong it complains about the "," any ideas? Probably a simple syntax error I'm missing

$query = ("SELECT * FROM bootleg_admin WHERE name = '$username' AND  pass = '$password'",mysql_real_escape_string($password));

Second question is how do I stop someone going straight to my admin pages by typing in the url? I have a login for myself to authenticate my user pass and redirect me to the admin pages although obviously I need to stop joe bloggs going direct there.

$query = "SELECT * FROM bootleg_admin WHERE name = '" . mysql_real_escape_string($username) . "' AND  pass = '" . mysql_real_escape_string($password) . "'";

 

[Dynix]

I coded my scripts to stop SQL Injections by doing the following:

$query = ("SELECT * FROM `bootleg_admin` WHERE name = '".$username."' AND  pass = '".$password."'",mysql_real_escape_string($password));

Changing 'whatever' to '".$whatever."' stops them (I was told, anyway - had no problems )

For the second question, set a cookie and check it on the admin-only page. I don't know how to this as my site is fully integrated with vBulletin, so it's easy. Did a quick Google and it pulled this up: http://php.about.com/od/finishedphp1/ss/php_login_code.htm

For the login part, instead of redirecting to the page, just include("the page");. That way the URL to the content you want to include is never shown / known.

Hope that makes sense / helps

Matt

 

[Dj_Jestar]

$query = "SELECT * FROM bootleg_admin WHERE name = '" . mysql_real_escape_string($username) . "' AND  pass = '" . mysql_real_escape_string($password) . "'";