Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #3811

Re: i getting this warning

Show all headers | View raw

Denis McMahon, 2011-11-16 16:11:

> On Wed, 16 Nov 2011 06:56:21 -0500, Jerry Stuckle wrote:
> 
>> On 11/16/2011 6:17 AM, sri kanth wrote:
> 
>>> $qs=$_REQUEST['id'];
>>> $data=mysql_query("select * from tbl_porduct where pid=$qs");
> 
>> Three things.
> 
> You missed "using unescaped user input in a query with no validation or 
> verification". I know it's only a select, but would you bet that he's 
> that sloppy with selects and yet rigorous with data changing statements?

It does not matter what statement there *is*. Using data from outside in
this way makes *everything* possible - this is the typical mistake which
makes SQL injection possible!


Example:

Lets assume $qs is "1;drop tlb_product".

$data = mysql_query("select * from tbl_product where pid=$qs");

The statement will be expanded to:

"select * from tbl_product where pid=1;drop tbl_product"

The result will be, that the table tbl_product will be dropped, if the
MySQL user has the right to drop tables.


So:

1) Do never trust data from outside

2) Always check results and do never assume successful execution


A better solution may be (requires at least PHP 5) - not tested (may
contain typos):

try
{
  if(!isset($_REQUEST['id']))
    throw new Exception('parameter id missing');

  $qs = $_REQUEST['id'];

  if(!is_numeric($qs))
    throw new Exception('parameter id not numeric');

  if(!mysql_connect('localhost', 'root', ''))
    throw new Exception('can not connect to database');

  if(!mysql_select_db('test'))
    throw new Exception('can not connect to database');

  $statement = sprintf("select * from tbl_product where pid=%d", $qs);

  $data = mysql_query($statement);
  if(!$data)
    throw new Exception('no product found');

  $rec = mysql_fetch_row($data);
  if(!$rec)
    throw new Exception('error fetching product record');

  $pname=$rec[1];
  $price=$rec[3];
  $sid=session_id();

  if(!mysql_query(
    "insert into tbl_spro values('$sid','$pname','$price')")
    throw new Exception('can not store values');
} catch (Exception $e) {
  // Handle exception here, $e->getMessage() will
  // return the messages provided above
}


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

i getting this warning sri kanth <sritullimilli@gmail.com> - 2011-11-16 03:17 -0800
  Re: i getting this warning The Natural Philosopher <tnp@invalid.invalid> - 2011-11-16 11:26 +0000
    Re: i getting this warning tony@mountifield.org (Tony Mountifield) - 2011-11-16 11:37 +0000
  Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-16 06:56 -0500
    Re: i getting this warning Denis McMahon <denismfmcmahon@gmail.com> - 2011-11-16 15:11 +0000
      Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-16 10:41 -0500
      Re: i getting this warning Arno Welzel <usenet@arnowelzel.de> - 2011-11-17 14:31 +0100
        Re: i getting this warning Arno Welzel <usenet@arnowelzel.de> - 2011-11-17 14:34 +0100
          Re: i getting this warning Denis McMahon <denismfmcmahon@gmail.com> - 2011-11-18 08:02 +0000
        Re: i getting this warning The Natural Philosopher <tnp@invalid.invalid> - 2011-11-17 13:39 +0000
        Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-17 09:01 -0500
          Re: i getting this warning Arno Welzel <usenet@arnowelzel.de> - 2011-11-17 15:15 +0100
            Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-17 09:44 -0500
              Re: i getting this warning Arno Welzel <usenet@arnowelzel.de> - 2011-11-21 14:59 +0100
                Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-21 09:12 -0500

csiph-web