SQL injection in auth adapter setIdentity() and setCredential()

Question

When I set up an auth adapter, to prevent sql injection, do I need to filter or process the user input before giving it to the setIdentity and setCredential methods?

This is my code. I use the unprocessed post data from $request->getPost('username') and feed it right into setIdentity() and setCredential(). Is this insecure? I've seen most blogging examples do this without doing anything else, but that could be bad practice. Do setIdentity() and setCredential() handle the input correctly when adding the data to the query?

$request = $this->getRequest();
$adapter->setIdentity($request->getPost('username'))
$adapter->setCredential($request->getPost('password'));

When you use PDO prepared statements, the SQL injection protection is handled automatically. You better worry about XSS or session security here. — takeshin, Dec 08 '10 at 16:03

score 3 · Accepted Answer · answered Dec 08 '10 at 12:40

If you look into the AuthAdapterClass you will see this method for building the query:

protected function _authenticateCreateSelect() {
// other code
//..
$credentialExpression = new Zend_Db_Expr(
            '(CASE WHEN ' .
            $this->_zendDb->quoteInto(
                $this->_zendDb->quoteIdentifier($this->_credentialColumn, true)
                . ' = ' . $this->_credentialTreatment, $this->_credential
                )
            . ' THEN 1 ELSE 0 END) AS '
            . $this->_zendDb->quoteIdentifier(
                $this->_zendDb->foldCase('zend_auth_credential_match')
                )
            );
}

They are using quoteInto so from my opinion no additional escaping is necessary.

score 0 · Answer 2 · answered Dec 08 '10 at 09:51

You should look at how your SQL statements are formatted. If you have parameterized SQL like "SELECT * FROM USER WHERE username=?" then you automatically avoid the problem of SQL injection. But if you format your SQL yourself like "SELECT * FROM user WHERE username='+$username+"'", then you may be vulnerable to SQL injection.

score 0 · Answer 3 · answered Dec 08 '10 at 10:39

i used to have two step validation :

when you build a login form , you could have added some filters and validaters [ for examples : rules for the username to be valid email address and the password to have letters and numbers only ] and your form won't pass the user input unless its valid
Zend_Auth_Db or any other Db based adapter like doctrine_adapter uses internally prepared statement which is secure :)

SQL injection in auth adapter setIdentity() and setCredential()

3 Answers3