安全登录表单，或者至少我希望如此

Question

I've written a new email form. I've implemented stuff suggested by some good folk around here and so I tried my best to make it both simple and secure, though I'm not sure if I succeeded in the latter considered that I'm stuck with older MySQL API for now. I feel like I have to explain why. It's because the whole site is using mysql and I have no time to switch to PDO, at least not for now.

I didn't run password through !preg_matchthough, not sure if that makes the input vulnerable to some kind of attack? I got a sense that when using !password_verify I can just sit back and relax.

Login form uses nickname, email and password to sign in.

Here's my code:

if (@$_POST['login']) {
    $nickname = mysql_real_escape_string($_POST['nickname']);
    $email = $_POST['email'];
    $password_input = $_POST['password'];
// validation 1 ------- //
    else if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
    $error = "Wrong nickname password or email.";
    }
    else if (!preg_match("/^[a-zA-Z0-9]{3,30}$/",$_POST['nickname'])) {
    $error = "Wrong nickname password or email.";
    }
// validation 2 ------- //  
        else { //password check
        $password_query = mysql_query ("SELECT password FROM userbase WHERE email='$email' && nickname='$nickname'"); 
        $password_actual = mysql_result ($password_query, 0);
        if (!password_verify($password_input, $password_actual)) {
        $error = "Wrong nickname, password or email.";
        }
            else {
            LOGIN SUCCESSFUL

Is !preg_match for $_POST['nickname'] needed if it's escaped by mysql_real_escape_string? (security vise)

Answer 1

MYSQL and MYSQLI functions are extremely vulnerable to SQL injection, even with mysql_real_escape_string.

How can I prevent SQL-injection in PHP?

I have converted your code from MYSQLI to PDO, which are SQL statements that are sent to and parsed by the database server separately from any parameters.

$con = new PDO('mysql:host=localhost;dbname=name', 'user', 'pass');

if ($_POST['login']) {
$nickname = $_POST['nickname'];
$email = $_POST['email'];
$password_input = $_POST['password'];
else if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
$error = "Wrong nickname password or email.";
}
else if (!preg_match("/^[a-zA-Z0-9]{3,30}$/",$_POST['nickname'])) {
$error = "Wrong nickname password or email.";
}else{ 
$password_query = $stmt = $con->prepare("SELECT password FROM userbase WHERE email=:email && nickname=:nickname"); 
$stmt->bindParam(':email', $email);
$stmt->bindParam(':nickname', $nickname);
$stmt->execute();
if($password_query->rowCount() > 0) {
$row = $stmt->fetch();
if(!password_verify($password_input, $row['password'])) {
$error = "Wrong nickname, password or email.";
}else{
 //LOGIN SUCCESSFUL
}