I am pretty new at php, quick note this is an android application that i am calling this script, I am not having the users make up the script lol. There is a series of checkboxs and when they check off certain ones it appends a script to the string builder. i am trying to run a query based on the value of a variable that is being passed in. Usually i do something like this,
mssql_query("UPDATE Userdata SET BrowseScript = '".$_REQUEST['sqlscript']."'
WHERE Userdata.Username = '".$_REQUEST['Username']."'");
and where it says .$_REQUEST[''] I can grab values that i pass in.
But this time the .$_REQUEST[''] is the whole script, so i want something like this
mssql_query($_REQUEST['sqlscript']);
and thats it i want it to run the query thats in that value, The query is correct, but it just will not return any value, I think i may have some type of syntax error or something, like i said i am new to php. Thanks for any help. Also I am not posting the whole code because everything is running ok, i just cant get that query to run. so all i need assistance with is the mssql_query part thanks again.
First of all there is huge security flaw in what you are doing. You should always sanitalize and escape the variables you use in your queries for example using mysql_real_escape_string or prepared statements.
Since you are importing whole script for your query, it could be that quotes are not escaped. You need to put these functions like this before your variables:
mysql_real_escape_string($_REQUEST['your_var']);
Using $_REQUEST in itself instead of proper $_GET or $_POST is vulnerable.
Tell your script to output the contents of $_REQUEST['sqlscript']
echo $REQUEST['sqlscript'];
Check that the output is correct. You might well find that there are some parsing errors, or just that your script is incomplete. Check for quotes (") and make sure the query is valid.
Also, you should never run a script from a request. Imagine if someone browsed to your site and typed
youtsite.com?sqlscript='drop * from tables';
Your entire database would be wiped.
For all that's holy, do not do this!
You do not just use request parameters and put them in SQL queries. You at the very least use mysql_real_escape_string (or whatever the MSSQL equivalent is, never used it). And you most certainly don't accept whole queries in the request and execute them sight unseen.
You're opening huge gaping security holes. Especially if you're new, stop that now before it becomes a habit!
example.com/foo.php?sqlscript=DROP TABLE users
Minimum required lecture: http://www.php.net/manual/en/security.database.sql-injection.php
Related
I have started studying PHP, and there is this one question that I don't seem to understand.
For eg. I have a PHP script at a URL: http://example.com/Test.php
If this script has a query that expects a parameter from the user (from a GET) then I could easily execute it like this:
http://example.com/Test.php?uid=2
where the query could be a
SELECT * FROM USERS WHERE UID = 2
Now I read that if I want to get sensitive information/upload to server I should use POST, but even if I use POST, I could still do the same in Postman with the parameters, and the query still executes.
I read about SQL injections and found that PDO is useful because it sends the query separately from the data to the server.
I have rewritten the first query with PDO, but I can still execute it with URL saying http://example.com/Test.php?uid=2. What am I doing wrong here? Am I misunderstanding something?
Questions:
Is having public access to the scripts normal? Because it seems very unsecure to me.
How is POST safer than GET when I can reproduce the same behavior in Postman?
Why can I still run my code with PDO's with entering parameters in the URL? Isn't the point that we send them separately to the server, and there it gets executed?
Now I read that if I want to get sensitive information/upload to server I should use POST
Forget sensitive. There is practically nothing security related in your choice of HTTP methods. The only thing is that your log files might record query strings in GET requests.
See this answer for further reading.
Is having public access to the scripts normal?
Yes. The entire point of giving a script a public URL is to provide information in public.
Why can I still run my code with PDO's with entering parameters in the URL?
The point of parameterized queries is to prevent SQL injection, where special characters are added to the data so that a query other than the one you intended to run is run. See Bobby Tables for a more in-depth explanation.
If you don't want people to run your query at all, don't give it a public URL.
If you want to limit what values people can pass into it, then write code which limits those values.
This might involve logic like:
If the user is not logged in:
send them to the login page
If the user does not own the comment they are trying to edit:
throw an error message
Otherwise:
run the UPDATE query
Using below code, i am not getting any errors. But the records i entered wont save to database php myadmin. Database wont update.
Several issues:
Don’t waste your time learning to make queries without using prepared statements. You’ll have to break the habit, so don’t learn it wrong in the first place
Your $col array in the object is constructed strangely. I doubt that’s what you want
When you implode $col, you’re not using the variable in the object. Wrong scope. When debugging, you should verify what the query is by printing it out before executing it. That would catch this error
Always pass variables to your methods instead of using globals. This helps prevent learning bad habits
Kudos for using an object. Make sure that each method only does one thing, and accurately returns success or failure
I need to pass special symbols through the URL for my MySQL query. For example, I need to have a URL that is something like:
www.example.com/index.php?q=AND name LIKE '%hi%'
When I tried it at first, I got a 406 error. I looked it up and apparently I have to use urlencode() and urldecode(). I put those in, and the 406 error went away, but then I got a MySQL error:
mysql_fetch_array(): supplied argument is not a valid MySQL result resource
Usually when I get these it means the query isn't written properly. So I echoed MySQL query, and everything looked fine. I even removed the urldecode() and hard-coded into a variable what I wanted to be passed to the page, and the MySQL error went away. However, both queries from using urldecode() and not using that are EXACTLY the same, so I'm kind of confused.
I went onto the php.net documentation page for urldecode(), and there was a warning that said something like using _GET and urldecode() together can result in unexpected things, and that _GET already functions as a decoder (or at least that's how I interpreted the wording), so I removed urldecode() but still left in the _GET, and that resulted in the text not being decoded, so I guess I didn't interpret the documentation correctly.
Is urldecode() not compatible with MySQL queries? I'm fairly certain it's an issue with the encode/decode, since I already tested my code with hard-coded info that bypassed the encode/decode, and it worked fine. Maybe the urldecode() is somehow turning the characters into special ones that look the same but are internally different so MySQL can't read them?
Don't do this. It's wrong. Anyone can of course just end the query using a ; and start a new one, deleting everything or reading out users and passwords.
One easy and much better way to do this is to use www.example.com/index.php?q=hi as your URL, then on the server (let's assume PHP)
$queryString = mysql_real_escape_string($_GET['q']);
$query = "AND name LIKE '%$queryString%'";
// Then replace $query for whatever you were using $_GET['q'] for before.
// Feel free to rename my variables what you like!
This way, the user can't mess things up, and the URL looks cleaner. the mysql_real_escape_string function makes the string safe to use in the query by escaping things. Read http://php.net/manual/en/function.mysql-real-escape-string.php for more on that.
If you still aren't convinced this is useful, consider what happens if someone publishes a link that will drop your tables, and then Google crawls it once a week. Your data will be removed any time that Google happens to swing by.
Once you are happy with this technique, read up on mod_rewrite (if using Apache) to clean the URL up even more, mysqli and how it is an improved version of the mysql functions, and finally PHP Data Objects (PDO) which helps to clean the PHP up even more.
Rich has the right general idea, but even better than quoting is to use database parameters. It essentially places a "variable token" into your SQL query, and then passes the variable separately. The query ends up looking something like this:
SELECT ID, VALUE1, VALUE2
FROM MY_TABLE
WHERE VALUE3 = :param
And then in your code, you add a value to substitute in for :param, and then send that to the database alongside your SQL. (On some DB libraries, you'd use a ? instead of a :parametername.) It works better than quoting for three reasons:
First, you can keep the query string constant instead of having to rebuild it every time, which improves performance in your server.
Second, if you send the same constant query to the database multiple times with multiple different parameters, the database engine can cache the query plan, which improves performance on the DB.
Third, when you get used to writing your queries in parameterized style, it becomes natural, especially if you use a query function that takes a parameter list as an argument, so it's hard to get wrong. By contrast, it's easy to forget to quote something, and then you've accidentally opened a security hole in your program.
Exactly how parameterization works depends on the database and the DB access library you're using, but every SQL database supports them. You should look at how it's done for the system you're using. It really is the best way to work with SQL, especially when you have input coming from untrusted sources such as the Internet.
At some point after calling mysql_query() and before calling mysql_fetch_array() you should check that the query didn't return false, and print mysql_error() if it did. e.g.:
$result = mysql_query($query);
if (!$result) {
die(htmlenitites(mysql_error())." when running <pre>".htmlenitites($query)."</pre>");
}
But:
You shouldn't be using php's mysql functions, you should use PDO, and you should use prepared / parameterized queries.
You shuoldn't be letting SQL be passed from the client unless you really trust anything the client might type - e.g. this is for a back-end admin interface, and even then, it's probably bad practice unless you really need it (like you are writing phpMySQLAdmin)
Keep in mind please that I am learning still. I am working on a website and I am simply adjusting and copying codes for the most part, from the existing ones, because that's the easiest way for me to understand them.
I keep getting an sql error that is caused by the use of apostrophes, and I've started putting in the mysql_real_escape_string() for every text field, which solved the individual problems.
Now this is genuinely just me asking for help. Please don't be sarcastic, I am really just trying to learn and this has been the best place to ask questions, so here:
Is there any way of fixing a general setup that will filter out the apostrophes that interfere? Basically anything that will help the site in general be protected against sql injection? Any help would be greatly appreciated :)
The general solution: all the parameters (values) should be passed through prepared statement placeholders
http://nz.php.net/manual/en/pdo.prepare.php
http://nz.php.net/manual/en/mysqli.prepare.php
Is there any way of fixing a general setup that will filter out the apostrophes that interfere?
Definitely NO.
Long time ago there was one, but nowadays it's defamed, deprecated and excommunicated (as it never worked as intended and failed it's purpose).
The problem you face is coming from the fact that SQL query being a program.
So, you have to follow the syntax rules creating this program, just like with any other program language. If you happen to create a PHP program, you have to take care of the irritating apostrophes as well - you can't put it all over the code in random places, but each have to have it's strict syntactical meaning, or - if an apostrophe being part of the data - it have to be properly escaped.
So, it is just syntax issue.
The best way to solve the problem is to separate the code from the data.
Native prepared statements gives you that possibility.
You can create a program - the query itself - and eventually bind some variables to it, so, the program code and the date being sent to the SQL server separately.
That's why prepared statements considered the best way of creating dynamical SQL queries.
But of course you have to bind each variable to it's query explicitly - so, there is no generalized way.
However, you can use some helper to do the binding automatically, so, the code become as concise as
$db->run("SELECT * FROM table WHERE id=?",$id);
which would be both short in writing and perfectly safe at the same time.
Using a data access layer that does this for you is a far better way than manually protecting each query parameter. Not only because it's tedious, but because there'll be that one critical parameter you'll forget eventually.
I used SafeSQL back when I still did PHP -- it's very light and unobtrusive... but plugging it in if you're a beginner might still be a daunting task.
Scenario:
I have a blog that I want to make a post to. I have a form set up where I can write out a blog post and submit it to a seperate php page that then stores it in a database (after it confirms it is me posting) where it will be read from and displayed on the home page. How can I easily escape any quotes or anything that will interfere with it being stored in the database but still allow it to be displayed properly (with all formatting intact)?
Thanks
Prepared statements in PHP will do a good job of taking care of sanitizing data as it goes into the database.
The only things that will interfere with it being stored in a MySQL database can be easily escaped by mysql_real_escape_string().
When you pull it out of the database, everything will look the same as before it was escaped and put in. Before you display it on a web page, you'll want to run htmlspecialchars() on the text to prevent any malicious scripting from having an effect.
An optional command would be strip_tags() if you don't want the text to contain any HTML at all.
Prepared statements are always a really good idea. But, you might consider moving your database code to a stored procedure. This will increase security and performance (in most cases, depending on what database you use and how you cache results).
If you are not going with the stored procedures route, also make sure to disable multiple lines of commands per call to database. This should be in the database config files. It will disable the possibility of doing this:
your command;malicious command
Although there are other ways, this is definitely the most secure.