note 111456 added to security.database.sql-injection
| From: | info at djdb dot be | Date: | Thu, 21 Feb 2013 10:06:51 +0000 |
| Subject: | note 111456 added to security.database.sql-injection | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-193714@lists.php.net to get a copy of this message | ||
please this function is under construction please let me issues
<?php
/**
* @author Lieven Roegiers
* @copyright 2009
* @CMS autosite
* opensource http://code.google.com/p/autosite/
* <script language='JavaScript' src='<?php print
$autosite['javascript']?>form.val.js'></script>
* <form onsubmit="return formCheck()" enctype="text/plain"
method="GET"></form>
*/
class valid{
public function is_valid(&$GETorPOST){
if(is_array($GETorPOST)){
foreach($GETorPOST as $key->$value){
if($this->is_phpkeyinject($key)){
return false;
}
if( $this->is_phpinject($value)||
$this->is_sqlinject($value)||
$this->illegalcharconverter($value)){
return false;
}
}
}
return true;
}
/**
* Prevention of
* files.php?login_id=1234567890 OR 1=1
* De volgende SQL query wordt uitgevoerd:
* SELECT * FROM files WHERE id = 1234567890 OR 1=1
*
*
* @param mixed $var
* @return
*/
function is_sqlinject($var){//DROP TABLE
return pos($var,"DROP TABLE")||pos($var,"DROP")||(pos($var," WHERE
") && pos($var," OR "))||pos($var,"SELECT * FROM");
}
/**
* @param mixed $var
* @return
*/
function is_phpinject($var){
return pos($var,"print_r")||pos($var,"DROP");
}
/**
* prevention of
* .php?a[]=asd&a[]=asdasd&b[]=$a
*
* @param mixed $var
* @return
*/
function is_phpkeyinject($var){
return pos($var,"[");
}
/**
* @param mixed $var
* @return
*/
function is_spaminject($var){
return pos($var,"sex")||pos($var,"SEX");
}
// %% (( ))
function illegalcharconverter($str){
$chars=array("&" ,"<" , ">" ,"!"
,'"' ,"," ,"$" ,"'" ,"*"
,"+" );
$ascii=array("&","<",
">","!",""",",","$","'","*","+");
return str_replace($chars,$ascii , $str);
}
}
?>
----
Server IP: 69.147.83.199
Probable Submitter: 213.118.47.34
----
Manual Page -- http://php.net/manual/en/security.database.sql-injection.php
Edit -- https://master.php.net/note/edit/111456
Del: integrated -- https://master.php.net/note/delete/111456/integrated
Del: useless -- https://master.php.net/note/delete/111456/useless
Del: bad code -- https://master.php.net/note/delete/111456/bad+code
Del: spam -- https://master.php.net/note/delete/111456/spam
Del: non-english -- https://master.php.net/note/delete/111456/non-english
Del: in docs -- https://master.php.net/note/delete/111456/in+docs
Del: other reasons-- https://master.php.net/note/delete/111456
Reject -- https://master.php.net/note/reject/111456
Search -- https://master.php.net/manage/user-notes.php