PHP - How Is This To Prevent Mysql Injection?

Based on the comments on my previous question, took some tutorials on how to avoid injections on query. Does the code below prevents against it in any way.? Secondly, can you recommend a good article that writes well in how to secure input data by users. Please be kind with your comments.😉😉. Thankks in advance.

The code works fine.
 

<?php 

include 'db.php';

error_reporting(E_ALL | E_WARNING | E_NOTICE);

ini_set('display_errors', TRUE);

 if(isset($_POST['submit']))

 {
    
 $username = $_POST['username']; 
$password =  ($_POST['password']); 

$sql = "SELECT * FROM customer WHERE username = ?";
$stmt = $connection->prepare($sql); 
$stmt->bind_param('s', $username);
$stmt->execute();
$result = $stmt->get_result();
$count =  $result->num_rows;
   if($count == 1) 
                         {
while ($row = $result->fetch_assoc())
 {
    if ($row['status'] == 'blocked')

 {

 echo'your account is suspended'


   session_destroy();

   exit();

  }

 else if($row['status'] == 'active')
{

if($username !== $row['username']) 

 { 
echo '<script>swal.fire("ERROR!!", " Username is not correct. Check Again", "error");</script>';
} 
if($password !== $row['password']) 
{
  echo'<script>swal.fire("ERROR!!!", "Your Password is Incorrect. Check Again.", "error");</script>';       
}
if($username == $row['username'] && $password == $row['password']) 
{ 
header('Location:cpanel/');
else
{
}
}//if count
}//while loop
}//submit
?>

 

Will this prevent a SQL injection? I am guessing the answer is no because it is too simple.


// retrieve form data   ==========================================

$ama = $_POST['ama'];

// Check for alphanumeric characters =====================================

$string = "$ama";

$new_string = preg_replace("/[^a-zA-Z0-9\s]/", "", $string);

// echo $new_string;

// Send query ===========================================================

$query = "SELECT * FROM members WHERE ama='$new_string'";
if (!mysql_query($query)){
die('Error :' .mysql_error());
}

Our admin panel for a gaming community was recently hit by a successful MySQL injection attack.
Here are the parameters they entered into forms to gain access.

Code: [Select]
${99319+100354}
Code: [Select]
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE acunetix [
  <!ENTITY acunetixent SYSTEM "http://testphp.vulnweb.com/dot.gif">
]>
<xxx>&acunetixent;</xxx>
Not sure which one worked, or how they even managed to POST to that page. But how do these two strings work? What do they do?

I have the following code ($c2 is my connection variable):
Code: [Select]
$host = $_GET['host'];
$loginQuery = mysql_query("SELECT * FROM sessions WHERE hostname LIKE '". $host ."' ORDER BY id DESC", $c2) or print(mysql_error());

In the URL, someone were to put host=127.0.0.1', they would have an error message spit out to them (something along the lines of: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''127.0.0.1'' ORDER BY id DESC' at line 1), indicating a SQL Injection exploit.

How would I go about fixing this, and also preventing SQL Injection?

Thanks a bunch,
Mark

Hello,

I have a syntax error on line 203 that is causing my code NOT work.
Could someone please look at it and tell me what is wrong & more important how to fix it?
Below is what I am getting. This " ~ " is server path info

" Parse error: syntax error, unexpected $end in /~ /~ /~ /phptestform/real_form_processing.php on line 203"

Also, how do I prevent "header injection", to keep my mail form from being open to abuse by spammers?

thanks
mrjap1



Code: [Select]

<?php # Script 

if (isset($_POST['submit'])) { // Handle the form.

// Register the user in the database.
require_once ('mysql_connect_page.php'); // Connect to the db.

// Create a function for escaping the data.
function escape_data ($data) {
global $dbc; // Need the connection.
if (ini_get('magic_quotes_gpc')) {
$data = stripslashes($data);
}
return mysql_real_escape_string($data, $dbc);
} // End of function.

$message = NULL; // Create an empty new variable.

// Check for a first name.
if (empty($_POST['first_name'])) {
$fn = FALSE;
$message .= '<p>You forgot to enter your first name... its Required!</p>';
} else {
$fn = escape_data($_POST['first_name']);
}

// Check for a last name.
if (empty($_POST['last_name'])) {
$ln = FALSE;
$message .= '<p>You forgot to enter your last name... its Required!</p>';
} else {
$ln = escape_data($_POST['last_name']);
}

// Check for an email address.
if (empty($_POST['email'])) {
$e = FALSE;
$message .= '<p>You forgot to enter your email address... its Required!</p>';
} else {
$e = escape_data($_POST['email']);
}

// Check for a address.
if (empty($_POST['address'])) {
$u = FALSE;
$message .= '<p>You forgot to enter your address... its Required!</p>';
} else {
$u = escape_data($_POST['address']);
}

// Check for a country.
if (empty($_POST['country'])) {
$u = FALSE;
$message .= '<p>You forgot to enter your country... its Required!</p>';
} else {
$u = escape_data($_POST['country']);
}


if ($salutation && $first_name && $last_name && $address && $city && $state_province && $zip_code && $email && $zip_code && $newsletter && $registration_date ) { // If everything's OK.

$query = "SELECT id FROM visitors WHERE address='$address'";
$result = @mysql_query ($query); // Run the query.
if (mysql_num_rows($result) == 0) {
// Make the query. This code is what you will use to prevent duplicate of usernames
$query = "INSERT INTO  `mrjap1_database`.`visitors` (`id` , `salutation` , `first_name` , `last_name` , `address` ,
`city` , `state_province` , `zip_code` , `country` , `email` , `newsletter` , `registration_date`) VALUES (
NULL ,  '$_POST[salutation]',  '$_POST[first_name]',  '$_POST[last_name]',  '$_POST[address]',  '$_POST[city]',  '$_POST[state_province]',  '$_POST[zip_code]',  '$_POST[country]',  '$_POST[email]',  '$_POST[newsletter]', '$_POST[registration_date]' , NOW() )";
$result = @mysql_query ($query); // Run the query.
if ($result) { // If it ran OK.

exit(); // Quit the script.

} else { // If it did not run OK.
$message = '<p>You could not be registered due to a system error. We apologize for any inconvenience.</p><p>' . mysql_error() . '</p>'; 
}

mysql_close(); // Close the database connection.

} else {
$message .= '<p>Please try again.</p>';
} 
} // End of the main Submit conditional.

// Print the error message if there is one.
if (isset($message)) {
echo '<font color="red">', $message, '</font>';
}
?>

<?php

// ALL THE SUBJECT and EMAIL VARIABLES

$emailSubject = 'MY TEST EMAIL SCRIPTING!!! ';
$webMaster = 'myemailaddress@gmail.com';



// GATHERING the FORM DATA VARIABLES

$salutation = $_POST['salutation'];
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$address = $_POST['address'];
$city = $_POST['city'];
$state_province = $_POST['state_province'];
$zip_code = $_POST['zip_code'];
$country = $_POST['country'];
$email = $_POST['email'];
$newsletter = $_POST['newsletter'];
    $registration_date = $_POST['registration_date'];
$date = date ("l, F jS, Y");
    $time = date ("h:i A");



$body = <<<EOD
<br /><hr><br />
<strong>Salutation: </strong>$salutation <br />
<strong>First Name:</strong>$first_name <br />
<strong>Last Name: </strong>$last_name <br />
<strong>Address: </strong>$address <br />
<strong>City: </strong>$city <br />
<strong>State_Province: </strong>$state_province <br />
<strong>Zip Code: </strong>$zip_code <br />
<strong>Country: </strong>$country <br />
<strong>Email:</strong> $email <br />
<strong>Zip Code:</strong> $zip_code <br />
<strong>Newsletter:</strong> $newsletter <br />
<strong>Registration Date:</strong> $date at $time <br />
EOD;

 
// THIS SHOW ALL E-MAILED DATA, ONCE IN THE E-MAILBOX AS READABLE HTML

$headers = "From: $email\r\n";
$headers .= "Content-type: text/html\r\n";
$success = mail($webMaster, $emailSubject, $body, $headers);


// THE RESULTS OF THE FORM RENDERED AS PURE HTML 

$theResults = <<<EOD
<!DOCTYPE HTML>
<html lang="en">
<head>
<style type="text/css">
body {
font-family:Arial, Helvetica, sans-serif;
font-size:11px;
font-weight:bold;
}

#thankyou_block {
width: 400px;
height: 250px;
text-align:center;
border: 1px solid #666;
padding: 5px;
background-color: #0CF;
border-radius:8px;
-webkit-border-radius:8px;
-moz-border-radius:8px;
-opera-border-radius:8px;
-khtml-border-radius:8px;
box-shadow:0px 0px 10px #000;
-webkit-box-shadow: 0px 0px 10px #000;
-moz-box-shadow: 0px 0px 10px #000;
-o-box-shadow: 0px 0px 10px #000;
margin: 25px auto;
}

p {
font-family: Arial, Helvetica, sans-serif;
font-size: 14px;
line-height: 18px;
letter-spacing:1px;
color: #333;
}

</style>
<meta charset="UTF-8">
<title>THANK YOU!!!</title>
</head>

<body>

<div id="thankyou_block">
<br><br><br>
<h1>CONGRATULATIONS!!</h1>
<h2>YOUR FORM HAS BEEN PROCESSED!!!</h2>
<p>You are now registered in our Database...<br>
we will get back to you very shortly.<br>
Please have a very wondeful day.</p>

</div>
</body>
</html>

EOD;
echo "$theResults"; 

?>