PHP and MySQL injections

so this topic gets hit a lot on the web, but i need a real quick easy, boiled down version of what i need to do with my code. I'm now doing some web development for a few different clients, and a few of them have asked for some database functionality, no problem, it's all set up and functional, using PHP and MySQL provided by the client's hosting company (not a good one, i dont like them, web.com) so here's the question, how do i protect from mysql injections. right now the only public access to the database is just the form to make an online reservation which links to a submit.php script that simply submits it. the client manages reservations with a web interface that is not linked to by anything, so you have to know the address, later i'll put a username and password on it in which case i know i'll have to protect against sql injections, but for now, is there any danger of sql injections. I'm assuming so. For some reason a few functions dont work on the hosting company's server (mysql_real_escape_string and free_result so far) and i think it's because its an older version of php or mysql. what can/should i do?

Sill man Wiki always has the answer lol

http://en.wikipedia.org/wiki/SQL_injection :-)

saw that one, it only shows the mysql_real_escape_string function which doesnt work with his hosting for w/e reason. it also has stuff for perl and java but mine's in php, thnx for the help though, any other suggestions?

also, while im here, rather than create a login app for the management system my comp sci teacher suggested putting it in a different directory and setting up permissions, but because its not a dedicated server im not sure thats allowed, but it does sound a lot easier, any suggestions there?

Hi,

I use both htmlentities(); and addslashes(); to remove nasty characters.

When echo-ing back to the screen in the admin area use stripslashes(); to bring it back to normal.

There are more involved methods like searching for and replacing particular strings/characters, but these cover the basics.

Here's a good primer on how to prevent some attacks via .htaccess and PHP -> http://www.0x000000.com/?i=50&bin=110010

Cheers,
Niggles

thnx, i'll look into those for sure, they look good. I'll have to test the functions. if anyone else has ideas dont be afraid to post, the more the merrier :)

It basically boils down to:

1. Don't pass any string directly into SQL without appropriate escaping - ideally use prepared queries
2. Audit use of dangerous functions such as eval(), system() etc, VERY bloody carefully.

There are other attacks you might want to consider as well:

- XSS - consider using a framework to automatically escape HTML in your output (e.g. if using a templating system like smarty)
- CSRF - consider using a framework which provides CSRF protection

Mark

All you really need to know is


mysql_real_escape_string

:-)

like i said, it doesnt work

The site says it is for "PHP 4 >= 4.3.0, PHP 5"
You can use phpinfo() to show what version you are running.

Its been mostly covered, most shard hosts will allowyou to setup an htaccess protected directory, what is the site managment app (Plesk, Cpanl, ect?) ? Stopeing sql injection isn't that hard so its ratehr disturbing that so much shows up online in PHP apps, first you need to take imput in as a var, adn the nbefore that is pushed into sql the submit.php should od so validation. if you can't get the canned scripts to work you will need to make your own. This isn't too difficult as you must know what the input can and can't be (length, charicter types, ect.). then escape the input to clean up whats left (some thing like mysql_escape_string(), or in a last resorte addslashes() ).

For the love of god don't store your db connection info in a plane txt file, it will be found and read.

This site is very good for looking into PHP security http://phpsec.org/projects/guide/3.html the link is their sql injection guide. beyond that remember security through obscurity isn' secure, i don't care if you didn't link the directory some one will find it (you are on a shared server, some one else may have been exploited and granted a shell, PHP file upload exploits are netorious for this and then your "hidden" directory is hosed)

Hey if you are still at it in may pick up a copy of SAMS Teach yYour Self PHP Security. I am hopeing to have it out in time for RSA.

From Here :

Quote:

---

Note: A MySQL connection is required before using mysql_real_escape_string() otherwise an error of level E_WARNING is generated, and FALSE is returned. If link_identifier isn't defined, the last MySQL connection is used.

Note: If magic_quotes_gpc is enabled, first apply stripslashes() to the data. Using this function on data which has already been escaped will escape the data twice.

Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks.

Note: mysql_real_escape_string() does not escape % and _. These are wildcards in MySQL if combined with LIKE, GRANT, or REVOKE.

---

I've seen mysql_real_escape_string fail to sanitize / work properly if something happened with the database connection...so you might want to check that it doesn't return FALSE. Also keep in mind that while it does a good job of sanitizing input, it doesn't make the input completely safe...for example, I've seen cases where its not necessary to use special characters to inject SQL and cause a desired outcome...you will still have to be careful/check the input before passing it on to the database and make sure it makes sense in the context provided...ie, if you are expecting an integer argument, don't accept a string (this is by far the most common thing I see)...