Jump to content

Archived

This topic is now archived and is closed to further replies.

lpxxfaintxx

MySQL Injection

Recommended Posts

Would adding addslashes and strip_tags to $_POST and $_GET's prevent MySQL injection? If not, what else can I do to improve my site's security?

Concerned Web Master,

LPXXFAINTXX

Share this post


Link to post
Share on other sites
yes the addslashes will stop MySQL injection.

this how i stop SQL injection.


[code]$Query = "SELECT * FROM table WHERE (field = '".  $Varible ."')";[/code]

Share this post


Link to post
Share on other sites
Please read [a href=\"http://shiflett.org/articles/security-corner-apr2004\" target=\"_blank\"]this[/a] article on MySQL Injection prevention.

Ken

Share this post


Link to post
Share on other sites
Any data set in $_SESSION variable should be completly trustworthy as you are the one that sets the session data after all! All session data is stored on the server so the user can not see what session data is being set while they are browsing your site. The only thing you'll want to be warry of with sessions is session fixation.

Share this post


Link to post
Share on other sites
[!--quoteo(post=363286:date=Apr 10 2006, 03:08 PM:name=lpxxfaintxx)--][div class=\'quotetop\']QUOTE(lpxxfaintxx @ Apr 10 2006, 03:08 PM) [snapback]363286[/snapback][/div][div class=\'quotemain\'][!--quotec--]
Would adding addslashes and strip_tags to $_POST and $_GET's prevent MySQL injection? If not, what else can I do to improve my site's security?

Concerned Web Master,

LPXXFAINTXX
[/quote]
the best and easiest way to do it is:
[code]mysql_real_escape_string($_POST['value'])) //(or $_GET)[/code]
more info:
[a href=\"http://php.net/manual/en/function.mysql-real-escape-string.php\" target=\"_blank\"]http://php.net/manual/en/function.mysql-re...cape-string.php[/a]

Share this post


Link to post
Share on other sites
[!--quoteo(post=363584:date=Apr 11 2006, 10:15 AM:name=wildteen88)--][div class=\'quotetop\']QUOTE(wildteen88 @ Apr 11 2006, 10:15 AM) [snapback]363584[/snapback][/div][div class=\'quotemain\'][!--quotec--]
Any data set in $_SESSION variable should be completly trustworthy as you are the one that sets the session data after all! All session data is stored on the server so the user can not see what session data is being set while they are browsing your site. The only thing you'll want to be warry of with sessions is session fixation.
[/quote]

I'm a moderator on an online game and we had a problem a while back where some players were stealing other player's session IDs and becoming them enabling them to take over accounts. The session IDs were extracted using Javascript and a special browser was used to make use of the stolen session ID.

The way I've got round it for my sites that use databases is to add two functions into the dbconnect include script, one called secureint() and the other securestr() depending on what data I'm expecting to pull from the user.

I've probably gone a bit overkill but here are the two functions:
[code]  function secureint($intstr) {
    settype($instr,'integer');
    $intint=sprintf("%d",$intstr);
    $intint=intval($intint);
    return $intint;
  }
  function securestr($oldstr) {
    $oldstr=trim($oldstr);
    $oldstr=strip_tags($oldstr);
    $oldstr=sprintf("%s",$oldstr);
    addslashes($oldstr);
    return $oldstr;
  }[/code]
And now a demo in use:
[code]$numericvar=secureint($_POST['age']);
$stringvar=securestr($_POST['name']);[/code]
They work like a charm.

Share this post


Link to post
Share on other sites

×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.