此代码是否可以逃脱，或者是否容易受到SQL注入攻击

Question

I'm running some tests for this login system im writing with my friend and we already had written our code with escaping, and not preparing. We're making sure it is invulnarable to anything put as a post_user and post_pass variable. Can you please check?

$_POST['post_user'] = mysql_real_escape_string($_POST['post_user']);

$_POST['post_pass'] = mysql_real_escape_string($_POST['post_pass']);

$query = mysql_num_rows(mysql_query("SELECT * FROM `users` WHERE
`user`='".$_POST['post_user']."' AND `pass`='".md5($_POST['post_pass'])."' AND
`rank`='0'"));

if($query == 1) {

$_SESSION[$this->host().'-us_user'] = $_POST['post_user'];

$_SESSION[$this->host().'-us_pass'] = md5($_POST['post_pass']);

$_SESSION[$this->host().'-us_token'] = $this->generateToken(16);

}

Answer 1

There are 2 faults with this approach, both coming from a single delusion.

mysql_real_escape_string doesn't "protect" your data. So, it should never be used for the purpose of whatever "sanitizing". Using this function like this, you are exposing yourself to two not immediate but quite possible dangers.

1. Escaping password before hashing it may spoil the resulting hash.
2. Escaping any value beside SQL strings will result in injection.

That's why you should always use parameterizing instead of "escaping". Just because parameterizing is doing its job, while "escaping" is used out of mere confusion.
I wrote a through explanation on the whole matter with escaping / parameterizing in a article you are welcome to read.