Re: sql injection php code for secure my page

Hey... Want to talk? Call me.... My telephone number >>>>

(+372) 56330687


Markus Heinz kirjutas Neljap=C3=A4ev, 5. veebruar 2015 kl 16:28:00 UTC+2:
> Hello.
> On 2015-02-05 at 12:08 Netman wrote:=20
>=20
> > Hello again!=20
> >=20
> > I know that to prevent from sql injection I have to check the parameter=
s=20
> > getting i.e. from $_GET variable=20
> >=20
> > I have questions:=20
> >=20
> > 1) Could you provide me sensitive words on which I should stop running =
the=20
> > following/the next code?
> In my opinion it is a better solution to have a whitelist than a=20
> blacklist. If you use a blacklist it will get complex and there is the=20
> possibility to miss some malicious input.
> > 2)=20
> >=20
> > I have written a function which check $_GET variable on such words as=
=20
> > SELECT, DROP, DELETE, JAVASCRIPT,=20
> > but it doesn`t work when the user sends a more than one dimensional arr=
ay=20
> > i.e. $_GET["action"][0] variable or $_GET["action"][0][0] etc=20
> >=20
> > so :=20
> > a) http://www.domain.com/index.php?action=3Dabout-me=20
> > my function doesn`t return any exception and the page is displayed=20
> >=20
> > and the following query is running and shows data:=20
> > $sql=3D"SELECT * FROM table WHERE cat=3D'".$_GET["action"]."'";
> You definitely have to escape $_GET["action"]. If you build your query=20
> this way it is wide open to sql injection. Use e.g.=20
> mysqli_real_escape_string or something similar appropiate for your=20
> database system.=20
> Another possibility is to use prepared statements. This will avoid SQL=20
> injection too.
> > b) http://www.domain.com/index.php?action=3DJAVASCRIPT=20
> > my function perfectly handles such exception and the page is not displa=
yed=20
> >=20
> > and the following query is not running:=20
> > $sql=3D"SELECT * FROM table WHERE cat=3D'".$_GET["action"]."'";=20
> >=20
> > becasue the user sends JAVASCRIPT value for $_GET form variable.=20
> >=20
> > b) http://www.domain.com/index.php?action[0]=3DJAVASCRIPT=20
> > my function doesn`t handle such exception and the page is displayed=20
> >=20
> > and the following query is running and but it doesn`t show any data:=20
> > $sql=3D"SELECT * FROM table WHERE cat=3D'".$_GET["action"]."'";=20
> > because=20
> > $_GET["action"] variable is an array in this case=20
> >=20
> > Questions:=20
> > 3) Do I have to create service in my parameter checking function when t=
he=20
> > $_GET is an array=20
> > like this $_GET["action][0], $_GET["action"][0][0] etc....=20
> > 4) Is it possible to run sql injection code when the quest is like this=
:=20
> >=20
> > $sql=3D"SELECT * FROM table WHERE cat=3D'".$_GET["action"]."'";=20
> >=20
> > and $_GET["action"] is an Array. Do I have to secure for such situation=
?
> If you expect $_GET["action"] to be an array in your parsing code you=20
> have to check and escape all of its values you process before using them.=
=20
>=20
> If you do not expect $_GET["action"] to be an array but it is you should=
=20
> not need to bother about it and can ignore it completely .=20
>=20
> Which case is valid for you depends on your application. But you should=
=20
> check the type of $_GET["action"] in any case in order to know if it is=
=20
> what you expect. If you do not expect an array for your application=20
> logic to work but it contains an array treat the parameter as missing=20
> and display an error page or handle the error otherwise.
> > Could you be so kind and answer my question?=20
> >=20
> > Kindest regards=20
> > Marcin
> Regards=20
>=20
> Markus