ansaurus

Question

Help with a MySQL query

Answer 1

A:

The code is vulnerable to SQL injections because user data is not escaped. Use mysql_real_escape_string

middus 2009-10-09 07:51:21

Answer 2

+1 A:

Googling for "SQL-injection" and "Input validation" should get you started.

Given the environment,

"Assuming "regsister_globals" and "magic_quotes_gpc" are turned on"

I believe that this case is meant to teach you the risk of both these settings.

The code snipped actually has 4 error related to "Never trust ANY information originating from outside your script", in combination with the above mentioned php-directives.

(There is a lot more wrong than just the 4 errors; there are a couple of "-" that should be "=" and a lower-case "_get" that should be upper-case etc. but my guess is that these are just typos.)

Jacco 2009-10-09 07:51:59

Answer 3

A:

mydql_fetch_assoc should be mysql_fetch_assoc

Kennethvr 2009-10-09 07:52:14

Lot of syntax problems in there, e.g. $filter - addslashes($_get["id"]);

middus 2009-10-09 07:53:16

Answer 4

A:

Try this:

<?php
$p = $_GET["p"];
if ($p == "index.php" && $_get["id"] == 345) {

 $filter = mysql_real_escape_string($_get["id"]);

 $sql = "SELECT * FROM users WHERE id = {$filter}";
 $row = mysql_fetch_assoc(mysql_query($sql));

?>
<html>
 ...... user details .....
</html>
<?php
}
else if (strpos($p, '../')===false && file_exists($p)) {
 include $p;
}

?>

Rowan 2009-10-09 07:54:46

Answer 5

+1 A:

This should get you started:

Hole 1: register_globals should be off - it's a security disaster.

$p = $_GET["p"];
// Where does $sp come from?
if ($sp == "index.php") {

     // What the hell? So much wrong with these two lines
     // 1. if id == 345 you don't need to addslashes
     // 2. "-" should be "="
     // 3. addslashes should be mysql_real_escape_string
     // 4. the if() should be removed so it runs every time
     if ($_get["id"] == 345)
          $filter - addslashes($_get["id"]);

     // SQL injection
     $sql = "SELECT * FROM users WHERE id = {$filter}";
     // Again with the "-" instead of "="
     // Typo in the function name
     // No error checking
     $row - mydql_fetch_assoc(mysql_query($sql));

     // No escaping of database input - vulnerable to XSS attacks
     echo <<< HTML
     <html>
           ...... user details .....
     </html>
HTML. // Should be ; not .
} else 
{
      // I can include /etc/passwd by manipulating the URL
      include ($p);
}

Greg 2009-10-09 07:58:31

It is a homework question. so register_globals is "on" as part of the question. Also, I think that you might have answered just a bit to fast, because not all your comments are correct.

Jacco 2009-10-09 11:09:22

Answer 6

A:

<?php
    $allow_includes = array(
      'some1', 'some2'
    );
    $p = $_GET["p"];
    if ($p == "index.php") {
         if ($_GET["id"] == 345) {
              $filter = mysql_real_escape_string($_GET["id"]);
         }

         $sql = "SELECT * FROM users WHERE id = '{$filter}'";
         $row = mysql_fetch_assoc(mysql_query($sql));
 ?>
    HTML. 
 <?php
    }
    elseif ( in_array($p, $allow_includes) ) {
      include ($p);
    }
    else {
      echo "Error 404";
    }
 ?>

Berkut 2009-10-09 08:04:06

ansaurus

tags:

views:

answers:

Help with a MySQL query

related questions