Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a PHP based website with a MySQL database. A few days ago I received an email containing all the users in the database along with their decoded passwords (the passwords were encoded using MD5).

After changing all passwords (ftp, database and the passwords from all the users), I received an email with the new info of the users.

I have used mysql_real_escape_string and htmlentities to sanitize the user inputs. Don't know what else to do in order to protect the site from another intrusion. Does anyone have any ideas on how could this have happened and what I can do to prevent it?

Your help is greatly appreciated!

share|improve this question

migrated from May 10 '11 at 7:18

This question came from our site for professional and enthusiast programmers.

did you check your FTP logs to see who's accessing the site? You might also want to switch to something like bcrypt to encrypt your passwords – JohnP May 10 '11 at 7:01
Check your web server log to see where the attack is coming from and which files are being attacked. Post part of the logs here so we can help you. – afarazit May 10 '11 at 7:01
Securing servers and web apps is a huge topic - you will need to provide some more information to even get speculative answers, like what kind of server your site is running on. – Pekka 웃 May 10 '11 at 7:02
While you changed all passwords there could be still a backdoor process running on the host. – PeterMmm May 10 '11 at 7:03
There are so many reasons why this could happen. From FTP access through simple passwords (you shouldn't access MySQL from any IP unless it's your server, BTW) and so on. You should really, REALLY read carefully the best practices in security for PHP apps. Also, don't use MD5 for passwords, for god's sake! You gotta encrypt them, not only encode them... – Vicente Plata May 10 '11 at 7:04
up vote 12 down vote accepted
  1. Ask the attacker. They contacted you (instead of keeping quiet and just sell the info) so presumably they also want to help you.

  2. Check all your SQL queries, looking for missed input escaping and such. Keep an extra eye on queries to the user table, especially if you do a SELECT *.

  3. Avoid SELECT * as much as you can - just select the fields you need.

  4. htmlentities does not correctly escape data to be inserted in SQL queries. You should always use mysql_real_escape_string for that. htmlentities and htmlspecialchars are used to sanitize data before ehoing it to the browser.

  5. Consider using prepared statements, for example with PDO. This will massively ease the task of securing against SQL injections, since data doesn't need to be escaped at all. (you still need htmlentities before echoing to the browser, but XSS is a different topic).

share|improve this answer
+1d you for the first point. That should be the first step. – JohnP May 10 '11 at 7:05
+1 Another option is "0. Take the site off line if it hasn't already happened" – Pekka 웃 May 10 '11 at 7:07
Pekka, indeed! One attacker contacting you does not mean he's the only one knowing about the flaw. This type of information is spreading fast. – Emil Vikström May 10 '11 at 7:10
Already tried to contact the attacker. He didn't want to give any more information. – miha May 10 '11 at 9:19
In addition to securing the site itself.. Don't use MD5, use a stronger hashing algorithm. And salt your hashes with additional random data to prevent rainbow table attacks. And require strong passwords.. presumably the passwords weren't very good if the attacker was able to get ALL of the source passwords from just an MD5 hash. – Shane Madden May 10 '11 at 16:03

Try to change your SQL querys to Prepared Statements.

Also contact your hoster to get some help from them.

Check for the latest patches of your CMS if you´re using one.

Use MD5 with a salt and multiple MD5 hashing rounds.

share|improve this answer
There's no proof that multiple hashing rounds would give better security. Multiple rounds may actually rise the collision rate. The other ones are good ways, though. Contacting the hoster may give some really good information if you're asking the right questions (they can check FTP logs, access logs etc). – Emil Vikström May 10 '11 at 7:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.