CRV2 SQLInjPHP - Revision history

Islam Azeddine Mennouchi at 18:35, 5 April 2014

2014-04-05T18:35:20Z

2014-04-05T18:07:43Z

2014-04-05T17:59:59Z

2014-04-05T17:57:34Z

2014-04-05T17:51:28Z

2014-04-05T17:40:03Z

2013-10-16T02:40:09Z

2013-10-16T02:39:47Z

2013-10-16T02:39:01Z

2013-10-16T02:38:35Z

@@ Line 68: / Line 68: @@
 ==References==
-'''See Reviewing code for Data Validation (in this guide)'''
+[http://www.php.net/manual/en/book.pdo.php PDO]
 {{LinkBar

← Older revision		Revision as of 18:07, 5 April 2014
Line 57:		Line 57:

	The PHP Data Objects (PDO) extension defines an abstract database interface that offers parameterized queries for prepared statements and stored procedures. It is available from PHP 5. Use of PDO::prepare will provide good SQL injection defenses, with some exceptions		The PHP Data Objects (PDO) extension defines an abstract database interface that offers parameterized queries for prepared statements and stored procedures. It is available from PHP 5. Use of PDO::prepare will provide good SQL injection defenses, with some exceptions
		+
		+	Example:
		+	<?php
		+	$id = htmlspecialchars($_GET["id"]); //Validation
		+	$sql = 'SELECT * FROM users WHERE id = :calories';
		+	$sth = $dbh->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY)); //prepared statement
		+	$sth->execute(array(':id' => $id));
		+	$red = $sth->fetchAll();
		+	?>

	==References==		==References==

@@ Line 55: / Line 55: @@
 the formula for Sql-injection-free code:
   Good Data Validation + Prepared Statement
 ==References==

@@ Line 52: / Line 52: @@
   ?>
-==Canonicalization==
+==Recommendation==
-Canonicalization is the process by which various equivalent forms of a name can be resolved to a single standard name, or the "canonical" name.
+the formula for Sql-injection-free code:
+ Good Data Validation + Prepared Statement
 ==References==

← Older revision		Revision as of 17:51, 5 April 2014
Line 58:		Line 58:

	With the myriad ways of encoding user input, a web application's filters can be easily circumvented if they're not carefully built.		With the myriad ways of encoding user input, a web application's filters can be easily circumvented if they're not carefully built.
−
−	~~==Bad Example==~~
−	~~public static void main(String[] args) {~~
−	~~File x = new File("/cmd/" + args[1]);~~
−	~~String absPath = x.getAbsolutePath();~~
−	}
−
−	~~==Good Example==~~
−	~~public static void main(String[] args) throws IOException {~~
−	~~File x = new File("/cmd/" + args[1]);~~
−	~~String canonicalPath = x.getCanonicalPath();~~
−	}

@@ Line 31: / Line 31: @@
 '''addslashes :'''
-addslashes() will only work if the query string is wrapped in quotes.A string such as the following would still be vulnerable to an SQL injection
+you will avoid Sql injection using addslashes() only in the case when you wrap the query string with quotes.The following example would still be vulnerable
   <?php

@@ Line 27: / Line 27: @@
 ==Suspicious Validation==
 The most common ways to prevent SQL Injection in PHP are using functions such as addslashes() and mysql_real_escape_string()
-but those function can always cause SQL Injections in some cases
+but those function can always cause SQL Injections in some cases.
 '''addslashes :'''
 addslashes() will only work if the query string is wrapped in quotes.A string such as the following would still be vulnerable to an SQL injection
@@ Line 36: / Line 37: @@
   ?>
 '''mysql_real_escape_string():'''
 mysql_real_escape_string() is a little bit more powerful than addslashes() as it calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a.
 As with addslashes(), mysql_real_escape_string() will only work if the query string is wrapped in quotes. A string such as the following would still be vulnerable to an SQL injection:

@@ Line 45: / Line 45: @@
   $bid = mysql_real_escape_string( $_GET['id'] );
   $query = 'SELECT title FROM books WHERE id = ' . $bid;
-−
   ?>

@@ Line 15: / Line 15: @@
 If your application gives the users the possibility to change parameters and those parameters are not verified and inserted
 in an unprepared statement than your code contain an SQL Injection.
 Example 1 :
   <?php
-  $a=$_GET["a"];
+  $pass=$_GET["pass"];
   $con = mysql_connect('localhost', 'owasp', 'abc123');
   mysql_select_db("owasp_php", $con);
-  $sql="SELECT * FROM user WHERE id = '".$a."'";
+  $sql="SELECT card FROM users WHERE password = '".$pass."'";
   $result = mysql_query($sql);
   ?>
-==Business Validation==
+==Suspicious Validation==
-Business validation is concerned with business logic. An understanding of the business logic is required prior to reviewing the code which performs such logic. Business validation could be used to limit the value range or a transaction inputted by a user or reject input which does not make too much business sense. Reviewing code for business validation can also include rounding errors or floating point issues which may give rise to issues such as integer overflows which can dramatically damage the bottom line.
+The most common ways to prevent SQL Injection in PHP are using functions such as addslashes() and mysql_real_escape_string()
 ==Canonicalization==