PHP - Sql Injection Problem

Hello,

I have a video game site - mostly vBulletin which is fine but there are a few extra bits to the site that I have done myself.

I'm pretty new to PHP so my code isn't great.

Anyway, I wanted to test my code for SQL Injection but I looked on Google and most of the tools seemed to come from hacker sites etc which I'm not downloading.

I eventually found an addon for Firefox called SQL Inject Me and ran that. It said everything was alright but when I checked my MySQL tables they were full of junk code it had inserted.

One of my pages doesn't even have any visible fields. It's just a page with a voting submit button and some hidden fields so how does it inject the code into the tables?

The insert page code is:

Code: [Select]
$db = mysql_connect("localhost", "username", "password");

mysql_select_db("thedatabase",$db);
$ipaddress = mysql_real_escape_string($_POST['ipaddress']);
$theid = mysql_real_escape_string($_POST['theid']);
$gamert = mysql_real_escape_string($_POST['gamert']);
$serveron = mysql_real_escape_string($_POST['serveron']);

$check= mysql_query("select * from voting2 where ipaddress='$ipaddress'");

$ipname = mysql_fetch_assoc($check);

if($ipname['ipaddress'] == $ipaddress) {
                     echo 'It appears you have already voted. Click <a href="vote.php">here</a> to return to the votes.';


} else {
mysql_query ("INSERT INTO voting2 (theid,ipaddress,gamert,serveron2)
                VALUES
('$theid','$ipaddress','$gamert','$serveron')");
 echo 'Your vote has been added. Click <a href="vote.php">here</a> to view the updated totals.';

}
How can I make it safer against SQL injection?

Thanks

Based on the comments on my previous question, took some tutorials on how to avoid injections on query. Does the code below prevents against it in any way.? Secondly, can you recommend a good article that writes well in how to secure input data by users. Please be kind with your comments.😉😉. Thankks in advance.

The code works fine.
 

<?php 

include 'db.php';

error_reporting(E_ALL | E_WARNING | E_NOTICE);

ini_set('display_errors', TRUE);

 if(isset($_POST['submit']))

 {
    
 $username = $_POST['username']; 
$password =  ($_POST['password']); 

$sql = "SELECT * FROM customer WHERE username = ?";
$stmt = $connection->prepare($sql); 
$stmt->bind_param('s', $username);
$stmt->execute();
$result = $stmt->get_result();
$count =  $result->num_rows;
   if($count == 1) 
                         {
while ($row = $result->fetch_assoc())
 {
    if ($row['status'] == 'blocked')

 {

 echo'your account is suspended'


   session_destroy();

   exit();

  }

 else if($row['status'] == 'active')
{

if($username !== $row['username']) 

 { 
echo '<script>swal.fire("ERROR!!", " Username is not correct. Check Again", "error");</script>';
} 
if($password !== $row['password']) 
{
  echo'<script>swal.fire("ERROR!!!", "Your Password is Incorrect. Check Again.", "error");</script>';       
}
if($username == $row['username'] && $password == $row['password']) 
{ 
header('Location:cpanel/');
else
{
}
}//if count
}//while loop
}//submit
?>

 

Will this prevent a SQL injection? I am guessing the answer is no because it is too simple.


// retrieve form data   ==========================================

$ama = $_POST['ama'];

// Check for alphanumeric characters =====================================

$string = "$ama";

$new_string = preg_replace("/[^a-zA-Z0-9\s]/", "", $string);

// echo $new_string;

// Send query ===========================================================

$query = "SELECT * FROM members WHERE ama='$new_string'";
if (!mysql_query($query)){
die('Error :' .mysql_error());
}

I want to know which part of my script has the hole..as i can find lots of php script and even folder can be injected into my public_html

how they do that, and which part need to be checked? is that the upload part <enctype> or what??

thanks in advance

ok here is my comment protection >< very basic and simple but i just got htmlentitied lol =[ how do i protect against that?
Code: [Select]
if (isset($_POST['submit'])) {

$comment= trim(stripslashes(mysql_real_escape_string($_POST['comment'])));
this is my registration protection, sql can still get though >< it doesnt work ?
Code: [Select]
$_POST['pass'] = md5($_POST['pass']);
  if (!get_magic_quotes_gpc()) {
  $_POST['pass'] = trim(stripslashes(mysql_real_escape_string($_POST['pass'])));
  $_POST['username'] = trim(stripslashes(mysql_real_escape_string($_POST['username'])));
  }

Hello People,

Been reading up on these and trying to understand them more.  Say I have a file called page.php?id=12345

and when users hit the page I run this code in the background:


$id = $_GET['id'];
$query = "UPDATE tbl SET live = '1' WHERE id = '".$id."'"; 


That page is not open to any attack right?  Even though i'm using $_GET.

Am I right in thinking that attacks only happen on online forms.  So for example there is no way an attacker could somehow output all the data in my table tbl


Thank yo

Does this code have mySQL Injection vulnerability?

$query = "DELETE FROM `$table` WHERE `$column` IN('".implode("','",$array)."')";

using php5, would this make the code more safe...

foreach($array as $key=>$a){
$array[$key] = mysql_real_escape_string($a);} 
$query = "DELETE FROM `$table` WHERE `$column` IN('".implode("','",$array)."')";

or is there another way to make the code safe?

been wondering about this for a while
do I need to put the escape on each WHERE? or do i really only need to put it on the $_POST
i can probably understand why i need it on $_GET also after WHERE. So wondering about the session id.

Code: [Select]
<?php mysql_query("UPDATE systems SET homes=  $homes + '".mysql_real_escape_string($_POST['homes'])."' 

WHERE address = '".mysql_real_escape_string($_GET['planet'])."' AND id = '".($_SESSION['user_id'])."'"); ?>

Well, I just want to know, if I add mysql_real_escape_string and strip_tags to a checkbox, does this mean it is 100% protected from SQL injection and XSS attack? For example:

Code: [Select]
<input type=checkbox' name="checkbox"/>

$checkbox = mysql_real_escape_string(stip_tags($_POST['checkbox']));

(I'm putting this in PHP since it's not a question specific to MySQL or other DB stuff.)   I have a page that uses the GET id to find a product. GET variables are sanitized, and the SQL string is escaped even though it's expecting a number only. So the code seems safe to me. I'm getting some error_log results that appear to be hack attempts:    SELECT 

i am using a Anti MySQL Injection my friend made for me

config.php
//Anti MySQL Injection
function anti_injection($sql) {
   // removes words that contain sql syntax
   $sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
   $sql = trim($sql); // strip whitespace
   $sql = strip_tags($sql); // strip HTML and PHP tags
   $sql = addslashes($sql); // quote string with slashes
   return $sql;
}

<?php 
include "./config.php";
$title = $_POST[title];
$type = $_POST[type];
$episode = $_POST[episode];
$year = $_POST[year];
$genre = $_POST[genre];
$status = $_POST[status];
$summary = $_POST[summary];
$pictures = $_POST[pictures];
$title = anti_injection($title);
$type = anti_injection($type);
$episode = anti_injection($episode);
$year = anti_injection($year);
$genre = anti_injection($genre);
$status = anti_injection($status);
$summary = anti_injection($summary);
$pictures = anti_injection($pictures); ?>
When i enter the data from the text box and click submit

it still puts the data in to the date base but it shows

]Notice: Use of undefined constant title - assumed 'title' in C:\wamp\www\studying\take 2\addin11.php on line 41

Notice: Use of undefined constant type - assumed 'type' in C:\wamp\www\studying\take 2\addin11.php on line 42

Notice: Use of undefined constant episode - assumed 'episode' in C:\wamp\www\studying\take 2\addin11.php on line 43

Notice: Use of undefined constant year - assumed 'year' in C:\wamp\www\studying\take 2\addin11.php on line 44

Notice: Use of undefined constant genre - assumed 'genre' in C:\wamp\www\studying\take 2\addin11.php on line 45

Notice: Use of undefined constant status - assumed 'status' in C:\wamp\www\studying\take 2\addin11.php on line 46

Notice: Use of undefined constant summary - assumed 'summary' in C:\wamp\www\studying\take 2\addin11.php on line 47

Notice: Use of undefined constant pictures - assumed 'pictures' in C:\wamp\www\studying\take 2\addin11.php on line 48

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

And thanks to the Anti MySQL Injection my Primary key in my database dont work :s
can you help? thank you

Hey Guys!
I have the following Working php script (receives the variables from Flash)


//LOGIN!
if ($action == "login")
{
//retreive data from flash
$username=mysql_real_escape_string($_POST['Username']);
$password=mysql_real_escape_string($_POST['txtPassword']);


$result = mysql_query("SELECT name, activated from buyers WHERE email = '$username' AND password = md5('$password')");

$cant = 0; 
    while($row=mysql_fetch_array($result))
{
echo "name$cant=$row[name]&activated$cant=$row[activated]&"; 
        $cant++;
    } 
    echo "cant=$cant&";

if (mysql_num_rows($result) > 0) 
{
echo "status1=exists";
} 
else 
{
echo "status1=Incorrect Login";
}
}


As you can see I have used mysql_real_escape_string for the variables $username and $password that are coming from Flash.
I would really appreciate some guidence if this is the only safe code I need in this script?
For example: Does $action == "login" need also mysql_real_escape_string ??
That variable $action is also coming from flash (but is not inputted by a user)

Any ideas?
Thanks in advance,
Cheers!

Hi all,

I thought instead of just simple do all the security stuff automatically, why not see for myself what the it can do.
So I made a simple table besides the other tables named delete_me,  made a form and started testing. But for some reason I can get that table to drop.

this is what i did on the front end with help from he http://en.wikipedia.org/wiki/SQL_injection

in all 3 fields (firstname, lastname email) put a value and in the last one i put:

but nothing happend.

if someone knows what i am doing wrong please tell me because I think it's vital in order to protect yourself one needs to know what he or she is up against.

im having some robots injecting gibberish

i wnat to deny amy links in the requesttext of the form
for some reason i tested it and it accepted a http link
Code: [Select]
if (preg_match("/http/i","$RequestText")){ exit();}

thanks

Hi,

I am using parameterized queries on my code, here's the relevant part

Code: [Select]
$params=$_POST['ITGtable'];

$tsql2 = "SELECT COLUMN_NAME, DATA_TYPE, ORDINAL_POSITION,
  COLUMN_DEFAULT, CHARACTER_MAXIMUM_LENGTH, IS_NULLABLE
  FROM INFORMATION_SCHEMA.COLUMNS
  WHERE TABLE_NAME=?";

/* Execute the statement with the specified parameter value.
Display the returned data if no errors occur. */
$stmt2 = sqlsrv_query( $conn, $tsql2, $params);
if( $stmt2 === false )
{
     echo "Statement 2 could not be executed.\n";
     die( print_r(sqlsrv_errors(), true));
}
else
{
     $qty = sqlsrv_fetch_array( $stmt2);
}
Do I really have to sanitize $_POST['ITGtable'] for apostrophe, semicolon, etc, to avoid SQL injection problems? Or just with above code I should be safer (I did not say safe) against SQL injection? And if the answer is "No", what could be the sanitize code of function? I am using sqlsrv and MS-SQL database engine; most of the functions we have for sanitize inputs on MySQL are not available for MS-SQL.

Thanks in advance,