Question about MD5?

[pappakaka]

I'm trying to secure my login system as much as possible from SQL injections and other attacks. I know that by using mysql_real_escape_string() you can prevent that and I'm using that on for example the username input, but I would like to know if you hash the password before you send it to the database with MD5, do you still need to use mysql_real_escape_string()?

 

A very quick and simple example:

 

<?php

$un = $_POST['username'];
$pass = $_POST['password'];
$pass = md5($pass);

mysql_query("SELECT * FROM users WHERE password='$pass' AND username='$un'");

?>

 

If someone wrote a possible SQL query in the password input, wouldn't that be rendered useless as the md5 will hash it before sending it and therefor "hide" it? Or is there any other reason you wouldn't want people to use sertain characters/symbols in their passwords?

[trq]

You don't need to escape special chars within an md5 hash because the special chars that are harmfull wont exist in the hashed data.

[pappakaka]

You don't need to escape special chars within an md5 hash because the special chars that are harmfull wont exist in the hashed data.

 

Ok thanks, so I can basically allow the users to use whatever characters they want in thier password? Or could that possibly be harmful any other way?

[ManiacDan]

md5 and sha1 are not suggested for password hashing anymore.  The crypt() function should be used.

[pappakaka]

md5 and sha1 are not suggested for password hashing anymore.  The crypt() function should be used.

 

Looked into it and it seems much better yes, thanks!