Hack my website?

[liamloveslearning]

Hi,

Ive just created a "Add to mailing list" form which allows a user to input there name and email which is then added to my table; there is no security on this besides a javascript validator to ensure fields are filled out, can hackers potentially hack my website due to this?

 

 

[cags]

Yes.

[liamloveslearning]

grim, what would be the best solution to look into to prevent that? is it something as simple as stripping out illegal characters or would it be server side?

[cags]

It's impossible to say without seeing your script. Since your script involves joining a mailing list and I know that involves a database, then it would require you to validate the input. Otherwise it may be possible for them to perform SQL Injections. The first thing you need to do is make sure any value being inserted into the database is being ran through mysql_real_escape_string. It may be prudent to also use something like preg_match to check the characters using in the name field and to also validate the e-mail, whether this be through a simple Regex or via a more complex validation class.

[liamloveslearning]

Okay cool, Ill have a read to read up about them, this is my code at the moment however..

 

<?php
$con = mysql_connect("localhost","db","pass");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("nl", $con);

$sql="INSERT INTO user_sub (name, email)
VALUES
('$_POST[name]','$_POST[email]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }


mysql_close($con)
?> 

[cags]

You are taking two values given directly by the user and inserting it into the database as-is, this is BAD. The very least you need to do is...

 

$sql = sprintf("INSERT INTO user_sub (name, email) VALUES ('%s','%s')",
         mysql_real_escape_string($_POST['name']),
         mysql_real_escape_string($_POST['email']));

[liamloveslearning]

thanks, im just reading about the real escape string now, in regards to my code being bad, shall I have to incorporate a lot of security features? thanks again for all your help cags I really appreciate it

[cags]

Once you've used mysql_real_escape_string, you have fixed the majority of problems you are likely to encounter. As I said you should probably validate the characters used in name, and probably validate the e-mail too, but that just a recommendation, strictly speaking not required. It also depends on what you do with the values from the database. If for example you ever output them in any manner you will might want to use htmlentities to prevent XSS attacks. Also if you don't do any validation on the email, somebody could enter 'name@domain.com,name2@domain.com,name3@domain.com', and use your script to e-mail lots of people. Combine that with not validating the name and they can completely hijack your script to send their own e-mail.

[liamloveslearning]

Ive incorporated the escape string yet i can still input illegal characters such as \x00; I read on php.net it should prevent this so I presume Ive done something wrong..

 

$sql = sprintf("INSERT INTO users (name, email) VALUES ('%s','%s')",

 

Im trying to understand this, by VALUES ('%s', does that mean the '%' characters are illegal characters? or have i gone completely off track?

[cags]

You're complete off, read the documentation for sprintf. The mysql_real_escape_string doesn't prevent you inputting anything it just escapes any potentially dangerous information so that it doesn't effect the query.

[liamloveslearning]

ahh brilliant, so escuse my description, it "disarms" the characters and inputs them plainly as text? Ill go read upon it now 

[thewooleymammoth]

idk if you were thinking that js would stop any kinda hacker either, js can be disabled so you shouldn't ever depend on it to stop hackers.