PHP - Script Injection?

Will this prevent a SQL injection? I am guessing the answer is no because it is too simple.


// retrieve form data   ==========================================

$ama = $_POST['ama'];

// Check for alphanumeric characters =====================================

$string = "$ama";

$new_string = preg_replace("/[^a-zA-Z0-9\s]/", "", $string);

// echo $new_string;

// Send query ===========================================================

$query = "SELECT * FROM members WHERE ama='$new_string'";
if (!mysql_query($query)){
die('Error :' .mysql_error());
}

I'm trying to use dependency injection to pass a database connection to an object but I'm not sure why it's not working.  I have my "dbClass" below that connects to a MySQL database. 

Code: [Select]
class dbClass {
public $db;

function __construct() {
$this->db = mysql_connect("localhost","username","password") or die ('Could not connect: ' . mysql_error());
return $this->db;
}
}

Then I have my "baseClass".  This is the class that I want to feed to connection too. 

Code: [Select]
class baseClass {
public $mysql_conn;

function __construct($db) {
$this->mysql_conn = $db;
$rs = mysql_select_db("webdev_db", $this->mysql_conn) or die ('Could not connect: ' . mysql_error());
}
}

And this is my index.php file.  The error I'm getting is "supplied argument is not a valid MySQL-Link resource".  However I tripled checked and my db connection details are definately correct. 

Code: [Select]
$db = new dbClass();
$baseclass = new baseClass($db);

Thanks for any help. 

Hello,

I have a video game site - mostly vBulletin which is fine but there are a few extra bits to the site that I have done myself.

I'm pretty new to PHP so my code isn't great.

Anyway, I wanted to test my code for SQL Injection but I looked on Google and most of the tools seemed to come from hacker sites etc which I'm not downloading.

I eventually found an addon for Firefox called SQL Inject Me and ran that. It said everything was alright but when I checked my MySQL tables they were full of junk code it had inserted.

One of my pages doesn't even have any visible fields. It's just a page with a voting submit button and some hidden fields so how does it inject the code into the tables?

The insert page code is:

Code: [Select]
$db = mysql_connect("localhost", "username", "password");

mysql_select_db("thedatabase",$db);
$ipaddress = mysql_real_escape_string($_POST['ipaddress']);
$theid = mysql_real_escape_string($_POST['theid']);
$gamert = mysql_real_escape_string($_POST['gamert']);
$serveron = mysql_real_escape_string($_POST['serveron']);

$check= mysql_query("select * from voting2 where ipaddress='$ipaddress'");

$ipname = mysql_fetch_assoc($check);

if($ipname['ipaddress'] == $ipaddress) {
                     echo 'It appears you have already voted. Click <a href="vote.php">here</a> to return to the votes.';


} else {
mysql_query ("INSERT INTO voting2 (theid,ipaddress,gamert,serveron2)
                VALUES
('$theid','$ipaddress','$gamert','$serveron')");
 echo 'Your vote has been added. Click <a href="vote.php">here</a> to view the updated totals.';

}
How can I make it safer against SQL injection?

Thanks

$_POST['user_name'] = "CLUEL3SS";
$_POST['user_pass'] = "test123";
$_POST['confirm_pass'] = "test123";
$_POST['user_email'] = "user@email.com";
$_POST['confirm_pass'] = 'user@email.com';

function testFunc($inputVars){
foreach($inputVars as $key=>$value){
$escapeData[$key] = mysql_real_escape_string($value);
}
return $escapeData;
}

var_dump(testFunc($_POST));



I'm trying to make a user system for my site and I want to make sure its secure enough to void off injection attackers. Any useful advice and and suggestions would be greatly appreciated!

Thanks!

Hey Guys!
I have the following Working php script (receives the variables from Flash)


//LOGIN!
if ($action == "login")
{
//retreive data from flash
$username=mysql_real_escape_string($_POST['Username']);
$password=mysql_real_escape_string($_POST['txtPassword']);


$result = mysql_query("SELECT name, activated from buyers WHERE email = '$username' AND password = md5('$password')");

$cant = 0; 
    while($row=mysql_fetch_array($result))
{
echo "name$cant=$row[name]&activated$cant=$row[activated]&"; 
        $cant++;
    } 
    echo "cant=$cant&";

if (mysql_num_rows($result) > 0) 
{
echo "status1=exists";
} 
else 
{
echo "status1=Incorrect Login";
}
}


As you can see I have used mysql_real_escape_string for the variables $username and $password that are coming from Flash.
I would really appreciate some guidence if this is the only safe code I need in this script?
For example: Does $action == "login" need also mysql_real_escape_string ??
That variable $action is also coming from flash (but is not inputted by a user)

Any ideas?
Thanks in advance,
Cheers!

Trying to make my code more secure.

This is what I currently have, which is not secure by any means:

Code: [Select]
$query1 = "SELECT COLUMN_NAME, DATA_TYPE, ORDINAL_POSITION, COLUMN_DEFAULT, CHARACTER_MAXIMUM_LENGTH, IS_NULLABLE
  FROM INFORMATION_SCHEMA.COLUMNS
  WHERE TABLE_NAME='$table'";
 
// Run PRO query

$qresult1 = sqlsrv_query($dbPRO, $query1);
if ($qresult1 === false) {
    exitWithSQLError('Retrieving schema failed.');
}
This is how I changed it,

Code: [Select]
$query1 = "SELECT COLUMN_NAME, DATA_TYPE, ORDINAL_POSITION, COLUMN_DEFAULT, CHARACTER_MAXIMUM_LENGTH, IS_NULLABLE
  FROM INFORMATION_SCHEMA.COLUMNS
  WHERE TABLE_NAME=?";
$params = array(1, $table);
 
// Run PRO query
$qresult1 = sqlsrv_query($dbPRO, $query1, $params);
if ($qresult1 === false) {
    exitWithSQLError('Retrieving schema failed.');
}
but I'm getting this error:

Code: [Select]
SQL-Status: 22018
Code: 245
Message: [Microsoft][SQL Server Native Client 10.0][SQL Server]Conversion failed when converting the nvarchar value 'sysrscols' to data type int
Please notice I am using sqlsrv_query function because my database engine is MS-SQL 2008. That's why I'm a bit confused. Most documentation online is pointed to MySQL.

exitWithSQLError is a customized function of mine, so please ignore. 

Any help or hints is appreciated,

Thanks,

im having some robots injecting gibberish

i wnat to deny amy links in the requesttext of the form
for some reason i tested it and it accepted a http link
Code: [Select]
if (preg_match("/http/i","$RequestText")){ exit();}

thanks

Hi,

I am using parameterized queries on my code, here's the relevant part

Code: [Select]
$params=$_POST['ITGtable'];

$tsql2 = "SELECT COLUMN_NAME, DATA_TYPE, ORDINAL_POSITION,
  COLUMN_DEFAULT, CHARACTER_MAXIMUM_LENGTH, IS_NULLABLE
  FROM INFORMATION_SCHEMA.COLUMNS
  WHERE TABLE_NAME=?";

/* Execute the statement with the specified parameter value.
Display the returned data if no errors occur. */
$stmt2 = sqlsrv_query( $conn, $tsql2, $params);
if( $stmt2 === false )
{
     echo "Statement 2 could not be executed.\n";
     die( print_r(sqlsrv_errors(), true));
}
else
{
     $qty = sqlsrv_fetch_array( $stmt2);
}
Do I really have to sanitize $_POST['ITGtable'] for apostrophe, semicolon, etc, to avoid SQL injection problems? Or just with above code I should be safer (I did not say safe) against SQL injection? And if the answer is "No", what could be the sanitize code of function? I am using sqlsrv and MS-SQL database engine; most of the functions we have for sanitize inputs on MySQL are not available for MS-SQL.

Thanks in advance,

Our admin panel for a gaming community was recently hit by a successful MySQL injection attack.
Here are the parameters they entered into forms to gain access.

Code: [Select]
${99319+100354}
Code: [Select]
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE acunetix [
  <!ENTITY acunetixent SYSTEM "http://testphp.vulnweb.com/dot.gif">
]>
<xxx>&acunetixent;</xxx>
Not sure which one worked, or how they even managed to POST to that page. But how do these two strings work? What do they do?

How can you protect mysql injection? (from inserting different statements into the input field)

Thanks

Does this code have mySQL Injection vulnerability?

$query = "DELETE FROM `$table` WHERE `$column` IN('".implode("','",$array)."')";

using php5, would this make the code more safe...

foreach($array as $key=>$a){
$array[$key] = mysql_real_escape_string($a);} 
$query = "DELETE FROM `$table` WHERE `$column` IN('".implode("','",$array)."')";

or is there another way to make the code safe?

been wondering about this for a while
do I need to put the escape on each WHERE? or do i really only need to put it on the $_POST
i can probably understand why i need it on $_GET also after WHERE. So wondering about the session id.

Code: [Select]
<?php mysql_query("UPDATE systems SET homes=  $homes + '".mysql_real_escape_string($_POST['homes'])."' 

WHERE address = '".mysql_real_escape_string($_GET['planet'])."' AND id = '".($_SESSION['user_id'])."'"); ?>

I need to create an entity which models the connection between a PHP server and another device so that a web app can change the entity's properties which in turn will update the server DB as well as the other device.  A little background information for context is as follows:

When a socket clients connects to the PHP server, it will register by providing its GUID, and in turn the server will query its DB to identify the specific client.  The client has various other properties associated with the socket connection such as reconnect_timeout, response_timeout, etc, and the associated values will also be stored in the server's DB.

While all socket clients use the same approach to communicate to the PHP server, several "flavors" of socket clients exists which use a specific protocol (Modbus/RTU, Modbus/IP, ControlNet, BACnet/IP, BACnet/MSTP, KNX, DALI) to communicate to downstream devices.  Based on the used protocol, there will be different properties as well as different methods (i.e. some protocols allow one to query the device to retrieve a list of available data).

To create the entity using inheritance, I would likely do so whe

class ModbusRtuSocketClient extends ModbusSocketClient (which extends SocketClient)
class ModbusIpSocketClient extends ModbusSocketClient (which extends SocketClient)
class ControlNetSocketClient extends SocketClient
etc..

But instead of doing so by using inheritance, I am thinking that I should do so through injection.  For instance, I create an object called SocketClient which just deals with that scope of work and is protocol agnostic.  I also create a second object which deals with a given protocol such as ModbusRtuProtocol extends ModbusProtocol extends Protocol.  I then do one of the following:

$entity = new SocketClient(new ModbusRtuProtocol());
//or
$entity = new ModbusRtuProtocol(new SocketClient());

//and do
$entity->setSomeSocketClientProperty(123);
$entity->getProperty()->setSomeSpecificProtocolProperty(321);
$entity->updateEndDevice();
$entityManager->persist($entity);
$entityManager->flush();

//or do
$values=$entity->queryDevice();

The first approach "seems" right, but I am not sure.  One concern is I cannot create a standard interface to govern all protocols because the methods are so protocol specific (maybe I need to think harder how to make a standard interface?).   Any recommendations where I should be going on this?

PS.  If you think I shouldn't be doing so through injection but through inheritance, please advise.

Hey Guys,
 
Hope you are all having a great day

I was hoping somebody could help me with preventing my blog from being attacked by SQL Injection. I made a simple blog in using PHP and MySQL but I keep getting spam comments (even though I use re-captcha) and some files were overwritten on my web server. For all my input I use mysql_real_escape_string but I still get the problem.

I found a video on youtube that showed how to enter stuff on the address bar like "order by 2--" and "union all select...." after passing a variable etc, and all of the things in the video could be replicated on my site   I am guessing that is my problem, but the video did not tell me how to resolve the issue and I am sick of having to delete hundreds of spam comments per day and check my web server for uploaded files.
 
How can I stop people adding these commands to the address bar and getting data from my database?  I really need your help
 
Thanx,
 
Jen