SQL injection attack - Dev Articles

Dev Articles Community Forums Sponsor:

April 2nd, 2004, 09:52 AM

lilleydn

Registered User

Join Date: Mar 2004

Posts: 11

Time spent in forums: < 1 sec
Reputation Power: 0

SQL injection attack

Hi

I am in happy stages of finishing my project off for university when some one happens to mention the phrase "SQL injection"

I now understand what it is but...

(To all those who dont, its the abilty to insert extra sql commands through a text field in form that could allow direct acces to the databse.
- i found really useful document at http://www.spidynamics.com/papers/S...nWhitePaper.pdf
It is in asp but the concept remains the same.)

Does the Sql Injection affect php? as i have tried and it returns /' instead of ' which is needed for SQL injection for example using the example code below if I was to SQL injection attack I could use the following.

Inserting this in to my form
1’;Drop project1 database; SELECT * from Table1 where a = ‘a

In ASP to the sql server it would appear
select a from Table1 where a =’1’;Drop project1 database; SELECT * from Table1 where a = ‘a’;
which would be terrible to my project as it would delete databse called project1

Where in php it would appear

select a from Table1 where a =’1/’;Drop project1 database; SELECT * from Table1 where a = /‘a’; which would make the sql query invalid and so not run.

Am I right that PHP is secure and safe from SQL injection attacks in this case? Or is there syntax to insert a ‘ with out a / ?

Any other security holes I should be aware of?

If you do know way of breaking to through this php and way to stop please let me know

The code for testing?

PHP Code:


		
			
<h1>Show </h1>

<?php # Records show – SQL injection test



echo('<form name ="search" method = get action ="'.$_SERVER['PHP_SELF'].'">');

?>



    <select name="field"  >

         <option value="a">A</option>

         <option value="b">B</option>

         <option value="c">C</option>

    </select>

     

     <select name="type"   >

         <option value="=">Equals</option>

         <option value="LIKE">Like</option>

         <option value="NOT LIKE">Not Like</option>

         <option value="!=">Not Equal</option>

     </select>

    

    <input type="text" name ="value" value="" size = "18">

    <input type ="submit" value="submit Query"><br>

</form>

<br>

<?

if(!($advanced=='true')){

$QUERY = "SELECT * from TABLE1";

if(strlen($value) !== 0 ){

    if(($type == 'LIKE')OR($type == 'NOT LIKE')){

        $QUERY .= " where $field $type '%$value%'";

        $searchfor .=" where the ".$field." is ".$type." ".$val;

    }else{

        $QUERY .= " where $field $type '$value'";

        $searchfor .=" where the ".$field." is ".$type." to ".$val;

    }

}



echo($QUERY);

}

?>

April 2nd, 2004, 11:00 AM

dhouston

Contributing User

Dev Articles Beginner (1000 - 1499 posts)

Join Date: May 2003

Location: Tennessee

Posts: 1,355

Time spent in forums: < 1 sec
Reputation Power: 7

You should really handle this in your code. I'm guessing that your server has the switch turned on that automatically escapes quotes. If you were to move your code to another server that didn't have this turned on and you didn't have other measures in place, you could find your code suddenly insecure.

One thing you can do is to always verify that you're getting what you expect. Run intval() on values that you expect to be integers, for example.

I also usually run a function on all GET and POST vars that runs some regular expressions on each value to make sure people aren't trying to inject SQL code. If I see "INSERT INTO [something]" or "DELETE FROM [something]" or other obvious attempts to inject SQL, I log the attempt and redirect to an error page before I've ever even gotten to the actual business logic of my code. This works fine for me because my applications aren't typically ones that require people to submit SQL code.

PHP's definitely not safe from SQL injection, and you should make sure your code's safe rather than relying on server settings that could change out from under you with nary a warning.

Sounds like you're heading down the right path and have a pretty good grasp on the issue.

__________________
Please don't PM me asking for solutions outside the scope of a thread.
Keeping all responses in a thread stands to help others who come along later,
which is after all what this forum's all about.

April 5th, 2004, 04:50 AM

lilleydn

Registered User

Join Date: Mar 2004

Posts: 11

Time spent in forums: < 1 sec
Reputation Power: 0

Many thanks for the reply.

I never thought it could be a setting in my server. I have to look in to this

Dave

April 5th, 2004, 09:15 PM

MadCowDzz

I'm Internet Famous

Dev Articles Frequenter (2500 - 2999 posts)

Join Date: Jan 2003

Location: Toronto, Canada

Posts: 2,890

Time spent in forums: 1 Week 16 h 14 m 9 sec
Reputation Power: 8

I read somewhere that simply replacing semicolons will a null character ruins most attacks... however this might also affect the data being sent (if its an essay or some kind of well paper which uses semicolons)...

Just another point of view

Thread Tools	Search this Thread
Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread: