note 111457 added to security.database.sql-injection
| From: | info at djdb dot be | Date: | Thu, 21 Feb 2013 10:10:19 +0000 |
| Subject: | note 111457 added to security.database.sql-injection | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-193715@lists.php.net to get a copy of this message | ||
code underconstruction let me now if there is an issue
<?php
/**
* @author Lieven Roegiers
* @copyright 2009
* @CMS autosite
* opensource http://code.google.com/p/autosite/
* <script language='JavaScript' src='<?php print
$autosite['javascript']?>form.val.js'></script>
* <form onsubmit="return formCheck()" enctype="text/plain"
method="GET"></form>
*/
class valid{
public function is_valid(&$GETorPOST){
if(is_array($GETorPOST)){
foreach($GETorPOST as $key->$value){
if($this->is_phpkeyinject($key)){
return false;
}
if( $this->is_phpinject($value)||
$this->is_sqlinject($value)||
$this->illegalcharconverter($value)){
return false;
}
}
}
return true;
}
/**
* Prevention of
* files.php?login_id=1234567890 OR 1=1
* De volgende SQL query wordt uitgevoerd:
* SELECT * FROM files WHERE id = 1234567890 OR 1=1
*
*
* @param mixed $var
* @return
*/
function is_sqlinject($var){//DROP TABLE
return pos($var,"DROP TABLE")||pos($var,"DROP")||(pos($var," WHERE
") && pos($var," OR "))||pos($var,"SELECT * FROM");
}
/**
* @param mixed $var
* @return
*/
function is_phpinject($var){
return pos($var,"print_r")||pos($var,"DROP");
}
/**
* prevention of
* .php?a[]=asd&a[]=asdasd&b[]=$a
*
* @param mixed $var
* @return
*/
function is_phpkeyinject($var){
return pos($var,"[");
}
/**
* @param mixed $var
* @return
*/
function is_spaminject($var){
return pos($var,"sex")||pos($var,"SEX");
}
// %% (( ))
function illegalcharconverter($str){
$chars=array("&" ,"<" , ">" ,"!"
,'"' ,"," ,"$" ,"'" ,"*"
,"+" );
$ascii=array("&","<",
">","!",""",",","$","'","*","+");
return str_replace($chars,$ascii , $str);
}
}
?>
----
Server IP: 69.147.83.199
Probable Submitter: 213.118.47.34
----
Manual Page -- http://php.net/manual/en/security.database.sql-injection.php
Edit -- https://master.php.net/note/edit/111457
Del: integrated -- https://master.php.net/note/delete/111457/integrated
Del: useless -- https://master.php.net/note/delete/111457/useless
Del: bad code -- https://master.php.net/note/delete/111457/bad+code
Del: spam -- https://master.php.net/note/delete/111457/spam
Del: non-english -- https://master.php.net/note/delete/111457/non-english
Del: in docs -- https://master.php.net/note/delete/111457/in+docs
Del: other reasons-- https://master.php.net/note/delete/111457
Reject -- https://master.php.net/note/reject/111457
Search -- https://master.php.net/manage/user-notes.php