| Re: i getting this warning [message #176021 is a reply to message #176019] |
Thu, 17 November 2011 13:31   |
Arno Welzel
Messages: 317
Registered: October 2011
Karma:
|
Senior Member |
|
|
Denis McMahon, 2011-11-16 16:11:
> On Wed, 16 Nov 2011 06:56:21 -0500, Jerry Stuckle wrote:
>
>> On 11/16/2011 6:17 AM, sri kanth wrote:
>
>>> $qs=$_REQUEST['id'];
>>> $data=mysql_query("select * from tbl_porduct where pid=$qs");
>
>> Three things.
>
> You missed "using unescaped user input in a query with no validation or
> verification". I know it's only a select, but would you bet that he's
> that sloppy with selects and yet rigorous with data changing statements?
It does not matter what statement there *is*. Using data from outside in
this way makes *everything* possible - this is the typical mistake which
makes SQL injection possible!
Example:
Lets assume $qs is "1;drop tlb_product".
$data = mysql_query("select * from tbl_product where pid=$qs");
The statement will be expanded to:
"select * from tbl_product where pid=1;drop tbl_product"
The result will be, that the table tbl_product will be dropped, if the
MySQL user has the right to drop tables.
So:
1) Do never trust data from outside
2) Always check results and do never assume successful execution
A better solution may be (requires at least PHP 5) - not tested (may
contain typos):
try
{
if(!isset($_REQUEST['id']))
throw new Exception('parameter id missing');
$qs = $_REQUEST['id'];
if(!is_numeric($qs))
throw new Exception('parameter id not numeric');
if(!mysql_connect('localhost', 'root', ''))
throw new Exception('can not connect to database');
if(!mysql_select_db('test'))
throw new Exception('can not connect to database');
$statement = sprintf("select * from tbl_product where pid=%d", $qs);
$data = mysql_query($statement);
if(!$data)
throw new Exception('no product found');
$rec = mysql_fetch_row($data);
if(!$rec)
throw new Exception('error fetching product record');
$pname=$rec[1];
$price=$rec[3];
$sid=session_id();
if(!mysql_query(
"insert into tbl_spro values('$sid','$pname','$price')")
throw new Exception('can not store values');
} catch (Exception $e) {
// Handle exception here, $e->getMessage() will
// return the messages provided above
}
--
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
|
|
|
|
Calendar
Search
Help
Members
Register
Login
Home
]