Online car market portal blind background, SQL Injection

Xss blind background, SQL injection in the background, password HASH stored in cookies details: the old routine, it is recommended to submit cookies to receive cookies cheat into the background, no link, cannot jump to other pages, it is too slow to inject SQL injection. It is found that the password HASH is saved in the _ php_auth_pw key of cookies and is logged in to the background.
 Solution:Filter the xss statement httponly, bind an IP address in the background, or reject the Internet access password. HASH is not saved in cookies.