Injection Boosters

[rarebit]

Since everyone seems to be asking about injection attacks I thought i'd ask about this one I found earlier today. It's in PDF format from www.milw0rm.com entitled Uncommon SQL Injection.

 

is there a standard way to combat this (i'm about to reread so...), e.g. not allow sql commands (prolly surrounded by spaces, but allow within other words)?

[DarkWater]

mysql_real_escape_string.  It'll escape any harmful things in a query.  =/

[rarebit]

mysql_real_escape_string() calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a.

 

There technically not harmful characters, but use sql functions in a special way. See the latter part of that document.

 

Admittedly there are only a few situations and in my case most can be caught with intval, but I wondering whether to write up a regex/strstr function, or whether one might already exist?

[benphp]

You can set your pages up to accept form values only from your IP address. I think that would fix this kind of attack.

 

<?php
if ($_SERVER['REMOTE_ADDR'] == $myip) {
   //allow variables.
}
?>

 

That sort of thing. I'm sure there are other ways to do it.

[rarebit]

Here's an example:

  www.site.com/news.asp?ArticleID=-1+UNION+SELECT+1,2,3+FROM+INFORMATION_SCHEMA.TABLES--

 

it's not 'HTTP_REFERER' issue! Is that an XSS or CSRF issue?

[DarkWater]

If you use mysql_real_escape_string, the QUERY WON'T INJECT ANYTHING AND IT'LL ESCAPE EVERYTHING.  =/  That "paper" can only take advantage of non-sanitized inputs. =/

[rarebit]

Just ran a test and it didn't sanitise it!

$s = "-1+UNION+SELECT+1,2,3+FROM+INFORMATION_SCHEMA.TABLES--";
print "::".mysql_real_escape_string($s)."::<br>";

 

this one conformed though...

$s = "' OR ''='";
print "::".mysql_real_escape_string($s)."::<br>";

[DarkWater]

Did you try it in a query?  No.  It wouldn't break the query or else mysql_real_escape_string would have caught it.

[rarebit]

TBH, I can't get it to work even without passing it through mysql_real_escape_string, lol

[Demonic]

use

sprintf