SQL Injection - Loop though post variables to get em!

[scotchegg78]

Hi Guys

 

I have this which works fine...

 

foreach ($_POST as $key => $input_arr) {
    $_POST[$key] = mysqli_real_escape_string($this->db_link,addslashes($input_arr));
	}

 

but it fails for $_POST variables that are arrays, so i have tried this approach, what am i doing wrong ?

 

foreach ($_POST as $key => $input_arr) {
		if(is_array($_POST)){
			foreach($_POST[$key] as $key2 => $input_arr){

				$_POST[$key][$key2] = mysqli_real_escape_string($this->db_link,addslashes($input_arr));

			}
		}else
		{
		   	$_POST[$key] = mysqli_real_escape_string($this->db_link,addslashes($input_arr));
		}
	}

 

Thanks for any help

[Orio]

You've used $input_arr twice. This should work:

 

<?php

foreach ($_POST as $key => $input_arr) {
if(is_array($input_arr)){
	foreach($input_arr as $key2 => $val){
		$_POST[$key][$key2] = mysqli_real_escape_string($this->db_link,addslashes($val));
	}
}else{
	$_POST[$key] = mysqli_real_escape_string($this->db_link,addslashes($input_arr));
}
}

?>

 

Although I still don't understand why you're using both addslashes() and real_escape_string() on the inputs- that's escaping some characters twice. I hope you're not with magic_quotes enabled as well, because in that case you're escaping the input three times..

 

Orio.

[DarkWater]

Yeah, you shouldn't addslashes().

[scotchegg78]

Yeah good spot, not sure how i get that in there to be honest.

 

 

Thanks Orio, Looks like it works now

 

 

[Orio]

Maybe you meant using stripslashes() to remove magic_quotes's effect?

 

Orio.

[waynew]

I usually just use:

 

$string = "' OR 1 = 1-- LOLOLOL HAX";
if(get_magic_quotes_gpc() == 1){ $string = stripslashes($string); }
$string = mysql_real_escape_string($string);

[Orio]

Yeah I do the same thing, just in a function:

 

<?php

function escape_str ($str)
{
if(get_magic_quotes_gpc())
	$str = stripslashes($str);
return mysql_real_escape_string($str);
}

?>

 

Orio.

[scotchegg78]

Guys

 

somehting I just noticed, I was using my function above, but then after that doing this..

 

 $this->description =  filter_input(INPUT_POST,"description",FILTER_SANITIZE_STRING); 

 

The value now in my variable is not the result of my sql inection funciton, its back to the header post ! Of course I can get around it using..

 

$this->description = filter_var($_POST['description'],FILTER_SANITIZE_STRING);

 

Unless anyone has any better cleaner ideas?

 

cheers