Updating Multiple Fileds with logged in user and SHA1 Password

Question

I've been looking around and can't find a place that is showing me an effective way to do this. Currently I have a query that runs when the user submits a form:

$query = "UPDATE user SET username='$_POST[username]',
nicename='$_POST[nicename]', 
email='$_POST[email]', 
password=(SHA1)'$_POST[password]', 
position='$_POST[position]', 
race='$_POST[race]', 
type='$_POST[type]' WHERE username=$_SESSION[admin_login]";

I'm not sure on how to get this to actually work correctly. Sorry if it's been asked before, but I can't find a good solution to this anywhere. Thanks in advance for any help.

Answer 1

First of all entire thing is wrong : Why?

Because first of all you need to sanitize the input, which you are not doing, atleast you should use mysqli_real_escape_string like this :

$nicename = mysqli_real_escape_string($connect, $_POST['nicename']);

Reference

Secondly you should encrypt the password before you use it in your query like assign your encrypted password to a variable and than use it in your query, like this :

$hashed_pass = sha1($_POST['password']);

//Query goes here

and last but not the least instead of using super global $_SESSION variable directly in your query, use concatenate it.. like this

WHERE username='".$_SESSION[admin_login]."'";

Answer 2

Firstly, always remember Little Bobby Tables. Inserting data like that can lead to SQL injection attacks just like in that cartoon. I'd highly suggest you use prepared statements, this is a feature in both PDO and MySQLi which are methods of reading and writing to a database using PHP, some info on: PDO and some info on: MySQLi.

Whichever you choose to go with doesn't really matter, it's more about personal preference. I like PDO, so here's an example of binding the data and then executing your query using PDO:

$dbh = new PDO("mysql:host=$host;dbname=$dbname", $user, $pass);  

$password = sha1($_POST[password]);

$stmt = $dbh->prepare("UPDATE user SET username = :username, nicename = :nicename, email = :email, password = :password, position = :position, race = :race, type = :type WHERE  = :username");
$stmt->bindParam(':username', $_POST['username']);
$stmt->bindParam(':nicename', $_POST['nicename']);
$stmt->bindParam(':email', $_POST['email']);
$stmt->bindParam(':password', $password);
$stmt->bindParam(':position', $_POST['position']);
$stmt->bindParam(':race', $_POST['race']);
$stmt->bindParam(':type', $_POST['type']);
$stmt->bindParam(':username', $_SESSION['admin_login']);

$stmt->execute();

Answer 3

$_POST and $_GET arrays can contain dangerous data, so you need prepare data from these arrays before inserting them into DB.

First, you need typecast values to right data types. In PHP you can use followed constructions: (string) for string data, (int) and (float) for numeric data, (bool) for boolean data.

Field email necessary checked for valid email, use Regex for it.

Follow code is sample of checking data:

<?php
    $link     = mysqli_connect('localhost', 'my_user', 'my_password', 'my_db');

    $username = mysqli_real_escape_string($link, (string) $_POST['username']);
    $nicename = mysqli_real_escape_string($link, (string) $_POST['nicename']);
    $email    = mysqli_real_escape_string($link, (string) $_POST['email']);
    $email    = preg_replace( '/^[_a-zA-Z0-9-]+(\.[_a-zA-Z0-9-]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*\.(([0-9]{1,3})|([a-zA-Z]{2,3})|(aero|coop|info|museum|name))$/', $email );
    $password = sha1((string) $_POST['password']);
    $position = mysqli_real_escape_string($link, (string) $_POST['position']);
    $race     = mysqli_real_escape_string($link, (string) $_POST['race']);
    $type     = mysqli_real_escape_string($link, (string) $_POST['type']);
    $admin    = $_SESSION['admin_login'];

    $query = "UPDATE `user` 
              SET `username`='$username',
                  `nicename`='$nicename', 
                  `email`='$email', 
                  `password`='$password', 
                  `position`='$position', 
                  `race`='$race', 
                  `type`='$type' 
              WHERE `username`='$admin'";

    mysqli_query($link, $query);
    mysqli_close($link);