Re: possible SQL command injection problem

On Tue, 23 Dec 2003 12:18:19 +0100
Moritz Bunkus <[email protected]> wrote:

> This yiels the following response:
> 
> Database error: Invalid SQL: SELECT * FROM attachidx WHERE atid =
> 8?cmd=ls
> MySQL Error: 1064 (You have an error in your SQL syntax. Check the
> manual that corresponds to your MySQL server version for the right
> syntax to use near '?cmd=ls' at line 1)
> Session halted.
> 
> I'm no expert for SQL (I know enough to get by and write my own movie
> database, but that's about all) so I can't say how serious this flaw
> is, but I have a pretty bad feeling about it.
> 
> Until this is resolved I've password protected my Anthill
> installation.


This should be easy to fix in the current cvs version of anthill, since
PEAR is being used. It is possible to bind variables with PEAR DB.

Something like this:

$db->query("SELECT * from users where username=?", array($username));

Instead of:
$db->query("SELECT * from users where username='$username'");

See: 
http://pear.php.net/distributions/manual/pear_manual_en.html.gz#package.database.db.db-common.query


Russell Valentine


_______________________________________________
Anthill-workers mailing list
Anthill-workers-+mQDA36h6dWw5LPnMra/[email protected]
http://vmlinuz.ca/mailman/listinfo/anthill-workers