doubledee Posted June 17, 2012 Share Posted June 17, 2012 (I'm sure to get hell for asking this...) What do I have to do to validate and/or sanitize my Log In form, consisting of E-mail and Password? I always use Prepared Statement. Some people would say, "Nothing. If they don't give valid credentials, the log in will fail?!" All I am currently checking for is empty(). I guess I could use the same Regex I used during Registration... Debbie Quote Link to comment Share on other sites More sharing options...
scootstah Posted June 17, 2012 Share Posted June 17, 2012 Some people would say, "Nothing. If they don't give valid credentials, the log in will fail?!" Yup. I guess I could use the same Regex I used during Registration... There's no reason to do that. If the username/password is invalid, it fails - there's nothing else to sanitize. Quote Link to comment Share on other sites More sharing options...
RobertP Posted June 17, 2012 Share Posted June 17, 2012 you will need to sanitize if you plan to use that information anywhere else. for example logging failed login attempts for admin accounts .. Quote Link to comment Share on other sites More sharing options...
scootstah Posted June 17, 2012 Share Posted June 17, 2012 you will need to sanitize if you plan to use that information anywhere else. for example logging failed login attempts for admin accounts .. You could sanitize it on output for that. I think it would be better to maintain data integrity in this case because it might help you to see if anyone is attempting to exploit/attack the system. Quote Link to comment Share on other sites More sharing options...
doubledee Posted June 17, 2012 Author Share Posted June 17, 2012 The only thing I can think to do is run my Log-In credentials through the same Regex that I used during Registration. Although I'd like to think that Prepared Statements solve 95% of any issues I'd have. Debbie Quote Link to comment Share on other sites More sharing options...
scootstah Posted June 17, 2012 Share Posted June 17, 2012 The only thing I can think to do is run my Log-In credentials through the same Regex that I used during Registration. I'd just like to know why you think that is necessary. Quote Link to comment Share on other sites More sharing options...
doubledee Posted June 17, 2012 Author Share Posted June 17, 2012 The only thing I can think to do is run my Log-In credentials through the same Regex that I used during Registration. I'd just like to know why you think that is necessary. Well, the short answer is "That is why I am asking here, because I am unsure." Several people seem to think I need to sanitize Log In data just like any other Form. It can't hurt. The fear would be, I suppose, SQL Injections, XSS, and whatever else. Again, since I am using Prepared Statements, I think if you were a hacker you'd be pretty helpless on my Log-In Form. If I checked that the Log-In E-mail and Password were valid formats, it would add a level of security, but I'm not sure how much... Obviously if my Form was to INSERT or UPDATE I'd scrutinize things much much more. But for Logging In, which is really "read-only", I personally don't think it is much of a risk, but then again, hackers are pretty smart!! Debbie Quote Link to comment Share on other sites More sharing options...
kicken Posted June 17, 2012 Share Posted June 17, 2012 Well, the short answer is "That is why I am asking here, because I am unsure." ... The fear would be, I suppose, SQL Injections, XSS, and whatever else. For something like a login all you need to do is you protect against SQL Injections. By using prepared statements, you have that covered. If for some reason you echo back the user-submitted values (such as to re-populate the username, or in an audit-log) then you'd want to protect against XSS by using htmlentities(). Beyond that, there is no need for any further validation/sanitation. If the username or password doesn't match whatever your rules are that you enforce during registration, it simply won't match anything in the database and the login will fail. Quote Link to comment Share on other sites More sharing options...
doubledee Posted June 17, 2012 Author Share Posted June 17, 2012 Well, the short answer is "That is why I am asking here, because I am unsure." ... The fear would be, I suppose, SQL Injections, XSS, and whatever else. For something like a login all you need to do is you protect against SQL Injections. By using prepared statements, you have that covered. If for some reason you echo back the user-submitted values (such as to re-populate the username, or in an audit-log) then you'd want to protect against XSS by using htmlentities(). Beyond that, there is no need for any further validation/sanitation. If the username or password doesn't match whatever your rules are that you enforce during registration, it simply won't match anything in the database and the login will fail. I think that nicely sums up my original thinking. Thanks, Debbie Quote Link to comment Share on other sites More sharing options...
RobertP Posted June 17, 2012 Share Posted June 17, 2012 to your question, should i validate against regex? well i do for my login system. but its not needed 100% as you have already validated their email address when they created their account. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.