PHP - Anti Mysql Injection

 is this select query code safe from injection?

try {
	$stmt = $db->prepare("SELECT * FROM posts WHERE key=$key");
	$stmt->execute();
	$row = $stmt->fetch();
} 

notice there is no bind.

$stmt->bindParam(':key', $key);

the reason i am asking is that i have many $key variable in the query and i do not know how to use bind in a query such as this...

SELECT count(*) FROM posts WHERE MATCH (file) AGAINST 
('$key' IN BOOLEAN MODE) OR MATCH (user) AGAINST ('$key' IN BOOLEAN MODE)

the $key is not an array and the $key does not change it's value.
Edited by kalster, 04 January 2015 - 05:52 PM.

I currently use the following function to clean form inputs to prevent MySql injection,

Does this function do enough to prevent MySql injection? is there anything i have missed?

 
<?php

//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}

?>

Using MVC, the controller does some logic, gets data from the model, and the view presents the content.   Where should the reverse be performed?   For instance, I have an edit page which is pre-populated with values from the model, and the view changes 1000 to $1,000, 0.4 to 40%, and 2014-10-09 09:31:41 to 10/09/2014 09:31:41 AM.   Now I need to save the values, and must convert them back to their original format before doing so.  Should this functionality be performed in the controller, model, or view?   Thanks      

This topic has been moved to PHP Freelancing.

http://www.phpfreaks.com/forums/index.php?topic=355195.0

Below is my contact from - and I have set anti spam question as I don't like captcha. How to I code the post/human bit so it is case insensitive?
I am a designer so I don't know what I am doing ☹️.

 

<div class="one-half-column-right" id="contactform">
 <form method="post" action="index.php#contactform">
<label>Name*</label>
<div class="clear"></div>
<input name="name" placeholder="Type Here">
 <label>Email*</label>
 <div class="clear"></div>
      <input name="email" type="email" placeholder="Type Here">
<label>Message</label>
<textarea name="message" placeholder="Type Here"></textarea>
 <label>*If today is Tuesday, what is tomorrow? <br> [lowercase answer please]<br> (Anti-spam)</label>
<input name="human" placeholder="Type Here">
<input id="submit" name="submit" type="submit" value="Submit">
</form>
 <?php
    $name = $_POST['name'];
    $email = $_POST['email'];
    $message = $_POST['message'];
    $from = 'From: Website Form'; 
    $to = ‘name@name.com’; 
    $subject = 'website form enquiry';
    $human = $_POST['human'];


$headers .= 'From: '.$from."\r\n".
    'Reply-To: '.$from."\r\n" .
    'X-Mailer: PHP/' . phpversion();
    $body = "From: $name\n E-Mail: $email\n Message:\n $message";
                
    if ($_POST['submit'] && $human == ‘wednesday’) {    
        if (mail ($to, $subject, $body, $from)) { 
        echo '<p style="font-family: Montserrat, Helvetica, Arial, sans-serif; font-weight: 600; text-align:center; font-size: 16px; color: #000; text-transform: uppercase; background-color: #FFD700"> 

     
      Request has been sent. We will get back to within 48 hours!<br></p>';

    } else { 
        echo '<p style="font-family: Montserrat, Helvetica, Arial, sans-serif; font-weight: 600; text-align:center; font-size: 16px; color: #000; text-transform: uppercase; background-color: #FFD700"> 

       Something went wrong, go back and try again!</p>'; 
    } 
    } else if ($_POST['submit'] && $human != '') {
    echo '<p style="font-family: Montserrat, Helvetica, Arial, sans-serif; font-weight: 600; text-align:center; font-size: 16px; color: #000; text-transform: uppercase; background-color: #FFD700"> 
    You answered the anti-spam question incorrectly!</p>';
    }
?>
    <!--// form //-->

    

Hi guys, I wrote this speck of code to prevent directory transversal. However, I'm not that great with security issues, so I would like some of the gurus to offer pointers/tips/hints as to whether my code is safe or not and how to improve it.
$pageID = $_GET["pageid"];
$pageNewIDLower = strtolower($pageID);
$pageNewID = ereg_replace("[^A-Za-z0-9]","",$pageNewIDLower);
if (strstr($pageNewID,"../") || strstr($pageNewID,"%") != true) {
// do stuff
}
else {
include("pages/home.htm");
}

If this looks wrong, let me know. I didn't take it directly from my php code as I'm on a cell phone at the moment.

Hello guys, i have a problem that i am trying to solve myself for the entire past week. I am not a php programmer and i wish you can help me.
There is a russian project called Crot Anti-Plagiarism, it is a open source moodle plugin. I started to use it and it is a really nice feature. The problem is that there are quite few people that are developing it and new features are coming once a year...
I see a big "hole" in this project (at least for me) : The plugin checks for plagiarism in the file that you submit only once, if a student resubmits the file it doesn't see that and you need to start the plugin's test again for all the files which is time consuming if you have a lot of submitted files to check.
I would like to add a function that will check if a file changed his modified date , if yes - mark for checking, if no - skip the checking.
I already added a similar function that checks if the name has changed, but it seems harder to check it by uploaded time(modified time).
Things i have already done:
I added a new column "assignment_submissions_timemodified" in database.
I added a new function that records the "time modified" of the file in the database.
But i can't add and i cannot make the comparison between the date of the first time the file submitted versus the date of the second time the same file was resubmitted.
Alright no more bullsh**t here is the code: (there are 3 comments that shows what i've changed, starting with  //my job...)
Thanks a lot!
Code: [Select]
$apath= $CFG->dataroot."/$assignment->course/moddata/assignment/$asubmission->assignment/$asubmission->userid";
        $timemodified= filemtime($apath);    //my job... it checks the file's modified time.
$files = scandir($apath, 1);
if (! $unprocessedsubm = get_record("crot_submissions", "submissionid", $asubmission->id, "crot_submission_file_name", $files[0], "assignment_submissions_timemodified", $timemodified))  //my job...now i guess here is the problem ( "assignment_submissions_timemodified", $timemodified)
{
        echo "$timemodified";
        echo "$unprocessedsubm";
print_r($unprocessedsubm);
echo "\nsubmission $asubmission->id was not processed yet. start processing now ... \n" ;
$atime = microtime();
$atime = explode(" ",$atime);
$atime = $atime[1] + $atime[0];
$astarttime = $atime;
if(!count($files))break;
//TODO we should verify if filename changed
//TODO add loop on the documents folder as well as loop for unzipping
$apath = $apath."/$files[0]";
// call tokenizer to get plain text and store it in crot_submissions
$atext = tokenizer ($apath);
// update the crot_submissions table
// delete if exists
delete_records("crot_submissions", "submissionid", $asubmission->id);
// insert the new record
$record->submissionid=$asubmission->id;
$record->updated = time();
$record->crot_submission_file_name = $files[0];                                   
$record->assignment_submissions_timemodified = $timemodified;        //this is my job.... it is recording the date as it has to.
$submid = insert_record("crot_submissions", $record);
// insert into documents
$docrecord->crot_submission_id = $submid;
Also i have attached the whole file crot_crone.php.

I am having a wamp issue so I can't try these out right now.  According to the book I'm learning php with, I can easily avoid injection attacks this way:    $a= stripslashes($a); $a= mysql_real_escape_string($a);   What concerns me is the repetition of the variable, $a.  Does it matter?  Intuitively, it should.    $a changes. By the time $a hits mysql_real_escape_string it is slash-free.  So it is a totally different "value" but still contained in the original variable which may have had slashes...just has me concerned a bit.   I know PDOs are the best way. I'm not there yet, unfortunately.
Edited by baltar, 23 May 2014 - 10:36 AM.

I'm confused, can this result in css/sql injection?

Code: [Select]

if(isset($_GET['action'])){
if($_GET['action'] == 'details'){
$cupID = $_GET['cupID'];
$ergebnis = safe_query("SELECT gameaccID, name, start, ende, typ, game, `desc`, status, checkin, maxclan, gewinn1, gewinn2, gewinn3 FROM ".PREFIX."cups WHERE ID = '".$cupID."'");
$ds=mysql_fetch_array($ergebnis);

...

Some german fellow was explaining, translate to English briefly:

"$ CupID is not escaped. NEN here I could just "; DROP TABLE` cups `Paste and your table is no longer available eez. Or I could inject javascript, your current session read out, accept it and act as an admin ... "

I am trying to understand what he means by this... is this query vulnerable to an injection and why/how? 

Will this prevent a SQL injection? I am guessing the answer is no because it is too simple.


// retrieve form data   ==========================================

$ama = $_POST['ama'];

// Check for alphanumeric characters =====================================

$string = "$ama";

$new_string = preg_replace("/[^a-zA-Z0-9\s]/", "", $string);

// echo $new_string;

// Send query ===========================================================

$query = "SELECT * FROM members WHERE ama='$new_string'";
if (!mysql_query($query)){
die('Error :' .mysql_error());
}

Hi,
I'm sure many of you heard of "pastebin", if not the short of it, is that you can submit your code (+100 languages), and you can display it to your friends via a link with syntax highlighting available.

So, One way to store the code is surely in txt files, but I would really prefer to have it stored in a mysql database.

My only concern is people trying to run a sql injection, so how do i get around all this? I don't want the user's content to be changed, but I don't want SQL injections either.. is this even possible at all?
Any tips appreciated, also if you could think of another alternative than txt files and mysql.

I'm trying to use dependency injection to pass a database connection to an object but I'm not sure why it's not working.  I have my "dbClass" below that connects to a MySQL database. 

Code: [Select]
class dbClass {
public $db;

function __construct() {
$this->db = mysql_connect("localhost","username","password") or die ('Could not connect: ' . mysql_error());
return $this->db;
}
}

Then I have my "baseClass".  This is the class that I want to feed to connection too. 

Code: [Select]
class baseClass {
public $mysql_conn;

function __construct($db) {
$this->mysql_conn = $db;
$rs = mysql_select_db("webdev_db", $this->mysql_conn) or die ('Could not connect: ' . mysql_error());
}
}

And this is my index.php file.  The error I'm getting is "supplied argument is not a valid MySQL-Link resource".  However I tripled checked and my db connection details are definately correct. 

Code: [Select]
$db = new dbClass();
$baseclass = new baseClass($db);

Thanks for any help. 

I want to know which part of my script has the hole..as i can find lots of php script and even folder can be injected into my public_html

how they do that, and which part need to be checked? is that the upload part <enctype> or what??

thanks in advance

Based on the comments on my previous question, took some tutorials on how to avoid injections on query. Does the code below prevents against it in any way.? Secondly, can you recommend a good article that writes well in how to secure input data by users. Please be kind with your comments.😉😉. Thankks in advance.

The code works fine.
 

<?php 

include 'db.php';

error_reporting(E_ALL | E_WARNING | E_NOTICE);

ini_set('display_errors', TRUE);

 if(isset($_POST['submit']))

 {
    
 $username = $_POST['username']; 
$password =  ($_POST['password']); 

$sql = "SELECT * FROM customer WHERE username = ?";
$stmt = $connection->prepare($sql); 
$stmt->bind_param('s', $username);
$stmt->execute();
$result = $stmt->get_result();
$count =  $result->num_rows;
   if($count == 1) 
                         {
while ($row = $result->fetch_assoc())
 {
    if ($row['status'] == 'blocked')

 {

 echo'your account is suspended'


   session_destroy();

   exit();

  }

 else if($row['status'] == 'active')
{

if($username !== $row['username']) 

 { 
echo '<script>swal.fire("ERROR!!", " Username is not correct. Check Again", "error");</script>';
} 
if($password !== $row['password']) 
{
  echo'<script>swal.fire("ERROR!!!", "Your Password is Incorrect. Check Again.", "error");</script>';       
}
if($username == $row['username'] && $password == $row['password']) 
{ 
header('Location:cpanel/');
else
{
}
}//if count
}//while loop
}//submit
?>