Hashed password must be sanitized?

Question

It's just a curiosity. If you encrypt a password (using sha1 or other methods) before inserting it in a query, it must be anyway sanitized? Or the hash's result is always safe?

This simple code are safe?

$salt = "123xcv";
$password = $_POST['password'];
$password = sha1($password+$salt);

$query = "select * from user where password='$password'";

Answer 1

Unless you validated the input somehow you shouldn't assume that it will always return a safe output because functions such as SHA1 can return error values if given unexpected input. For example:

echo '<?php echo sha1(''); ?>' | php 
Warning: sha1() expects at least 1 parameter, 0 given in - on line 1

And this output obviously violates the assumption that "it's always a hex string". Other hashing functions in other languages can present yet another behaviour.

Apart from that, the above password hashing code scheme ($password = sha1($password+$salt);) is very weak (see why) and I would strongly recommend not using it even in an example as someone is eventually guaranteed to find it on StackOverflow and use in production.

Also, as already noted above, building SQL queries by concatenating strings is also a bad practice and can lead to security issues in future: today the only parameter in the query will be the password, tomorrow someone decides to add some other option and I bet they won't rewrite the query but just use the template that is already there...

Answer 2

From the documentation:

The value is returned as a string of 40 hex digits, or NULL if the argument was NULL.

Assuming you have a large enough varchar column, you have no sanitization to do.

This being said, it's always cleaner to use prepared statements, there's no reason to just concat strings to build queries.

Answer 3

This sql injection question question is asked out of a common delusion.

In fact, there is no such thing like "sanitization" at all, nor any function to perform such non-existent task. As well as there is no "safe" or "unsafe" data. Every data is "safe", as long as you're following simple rules.

Not to mention that a programmer have a lot more important things to keep in mind, other than if some particular piece of data is "safe" in some particular context.

What you really need, is to avoid raw SQL for such silly queries at all, using an ORM to run SQL for you. While in such rare cases when you really need to run a complex query, you have to use placeholders to substitute every variable in your query.