Topic awaiting preservation: PHP injection security? (Page 1 of 1)

Hi all...

Just wondering, ive turned magic quotes off on my server as it causes all amounts of problems! Obviously now I have to manually addslashes to my $_POST and $_GET variables which i am using, before I use them in my mysql Query.

To do this I am using mysql_real_escape_string... this part is all fine.


The question I have: is there a vulnerability in using these variables around a php script before they have slasshes added.

E.g

Say i have a simple POST form, with an input field called myVar.

So in php to use this i do

$myVar = $_POST['myVar'];

I then use $myVar around the script, check it for characters I want to allow and that sort of thing. If it contains invalid characters i will do somethign like

print $myVar . 'contains invalid characters, please try again';

So ... can someone enter something into the input field with some php code, to break out and enter any php they want? Like could they do "'somavar'; <?php insert some bad php here ?>

Basically can they use the $_POST variable to break out of my code and enter there own in the current script?

Or is it only a security issue if you use eval() ?

That would only be an issue if you were using eval(), but, you're always open to cross site scripting if you don't php->htmlentity() everything you output (preferably: When you output it).

Eval() is very very rarely used. In all truth, the only time I've found it usefully and sensible was in factory methods, since PHP apperantly doesn't like

$obj = new $var ( ... );

so you had to do it like

$obj = eval('return new '. get_class($this). '();');

so long,

->Tyberius Prime

Thanks TP,

yeh ive just set it up a bit better, a few scripts for error handling, sql injection preventing, anti magic quotes and htmlentitying everything before I output it..



Is there a way that you can do that on a larger level, as far as i can tell it has to be done for each variable you are about to output. Cant do it on all of your html because it will just print code!

So just to clarify...


I prevent SQL injection by doing adding slasshes to my variables before they go in the sql

I prevent some other strange stuff by htmlentities on any variables just before I output them

I have register globals off and always declare my variables before I use them.

I never use eval, so even though the variables are unprotected, unslashed and may contain harmful code, they shouldnt be able to do anything



Apart from dealing with email injection, is that really all I need to protect against? Am i missing anything?

Globals overwrite - in case your code ever runs under a system with register globals on.

on the same node - unregistering autogloabls if register_globals is on.

Cool thanks, yeh I turn register globals off in htaccess, but i have never actually used registered globals anyway.

I do use $_SERVER a bit, I wonder if these can be hacked and set in the same way as globals? I think they are superglobals, not sure at what point they are set etc though.

The other thing i need to do is start using strong passwords, I want to make sure my database is secure so strong passwords is a must i guess!





On a side note, i don't use PEAR for anything, is it just a set of common functions to do things or is there something special about it?

TP

I was just wondering why you suggest doing htmlentities() on output rather then doing it before you store the input in question?

- Butcher -

Actually i can't remember what I was reading but they said you shouldn't store htmlentitied data in your database. Its meant to be used for the html you are about to output, purely so that certain characters (say quotes ") show up.

You are better off storing the raw data in your database, that way you always have the option of changing how you output it and what you do to it.

because one of these day, you might wish to do something else with the data in your database - and then the entitites are going to be a hazzle.

Nevertheless, this very forum does just that - it's not a general no no, you can easily get by with a smart unhtmlentities() routine, but, conceptually, you are wrapping the text for a special kind of output, so do it when you do that special output.

Makes sense.

Thanks guys.

- Butcher -