WHERE statement issues UPDATEing all rows

Question

I have an issue in my app where the "change my password" functionality has reset ALL user's password to the same value. I restored a backup, so no major problems, apart from this awful bug through no fault other than my own.

Obviously this was due to the WHERE condition in the UPDATE statement having no value. This was via an active record query in CodeIgniter. To avoid this issue there was a safeguard in place:

if( !is_numeric($userdata['client_id']) ) die('could not retrieve user ID from session');

A typeof($userdata['client_id']) tells me this is a "string" so my is_numeric check should have worked fine. the $userdata array comes from the session.

There are no users with client_id 0, they all have a number value.

I thought this could have occurred through the user accessing the "change password" page, waiting till the session logged him out after X minutes and then submitting the form. I tried this myself and it just redirects me back to the login page, as it should.

My WHERE statement tries to match the $userdata['client_id'] against a client_id_fk value. One or two test clients have a client_id_fk of NULL - could such a test client resetting their password have caused this?

If not, I'm stumped. Anyone?

Answer 1

Hi stef

I thought this could have occurred through the user accessing the "change password" page, waiting till the session logged him out after X minutes and then submitting the form. I tried this myself and it just redirects me back to the login page, as it should.

From above it seems to be you are submitting form details after clearing session details userdata, so userdata wont be available for password update query.

Also all the records get updated means is_numeric($userdata['client_id']) is not working as expected.

Could you please try to submit form details first and then logged out the session?

Answer 2

My first guess would be that $userdata['client_id'] was null and is_numeric() is (misleadingly) returning true?

Answer 3

is_numeric() returns true for a whole load of strings. Assuming your client_id field is always an integer (it should be), then using is_int() might be a better idea. If the client_id is not being retrieved as an integer (or you are reading it from $_GET), then you also might want to consider casting it using (int), for example:

$userdata['client_id'] = (int) $_GET['client_id'];

This should ensure the value you're working with is an integer, and not something like +1e10 (which would return TRUE in the is_numeric() check.

http://uk.php.net/manual/en/function.is-numeric.php

In addition, you should try to var_dump() your value instead of running it in your query to debug it.