22 replies to this topic

[sirhenry]

Yikes! I just found out about this. It's really something to watch out for when making SQL of any sort, not just log-ins. Fortunately, it's relatively easy to circumvent.

Check it out:

[quote name='"A man wiser than I"']What is an SQL Injection attack?

An SQL Injection attack happens when a user gives your script data crafted to change your SQL to do something you didn't intend it to do. Consider this SQL:

$sql = 'SELECT * FROM users WHERE username="'.$username.'"
AND password="'.$password.'"';
if (mysql_query($sql)) {
  echo 'Logged in!';
}

It looks fine, but what if a user submitted this as their password:

" OR 1=1 OR ""="

This would cause the SQL to read:

SELECT * FROM users WHERE username="" AND password="" OR 1=1 OR ""=""

which would allow the attacker to get into your system without even knowing a login!

On many databases you can also run multiple queries by putting a semicolon in the SQL you pass. Consider this password:

"; DELETE FROM users WHERE ""="

This would run the first query, which would probably find no records, but it would then run the DELETE query which would delete all of yoru users. Note that this could also be used to delete any other data in yoru system or to change your data or insert a new user with admin priviledges.

To protect against this, you need to "escape" the variables you put into your SQL. When using Mysql you can do this:


$sql = 'SELECT * FROM users WHERE
username="'.mysql_real_escape_string($username).'" AND
password="'.mysql_real_escape_string($password).'"';


If you're using PEAR::DB you can do this (this will work for *any* database system that DB supports):

$sql = 'SELECT * FROM users WHERE
username='.$db->quoteSmart($username).' AND
password='.$db->quoteSmart($password);[/quote]


Pretty scary stuff, huh? ::shocked::


Note: this is taken from [url="http://www.reversefold.com/tikiwiki/tiki-index.php?page=PHPFAQs#id601011"]this wiki[/url], and the rightful author(s) of this information deserve all credit due.

[Xedos]

Wow. I've knew about SQL Interjections for ages. I however never knew what they did. This as explained it all to me. Thanks!

[maddog39]

I know someone who had and sql injection attack on there phpBB forum and the hacker logged into the ACP and kaked everything and left a message on his homepage, lol.

[Roly]

or you can use htmlentites() or addslashes()

[OpaQue]

This is a very helpful information that you have contributed! And it must be known by many programmers.

I have Granted you 2 Hosting Credits as reward!

[King-Squad]

What are hosting credits by the way?

[OpaQue]

http://www.trap17.com/forums/

[King-Squad]

ooo gotcha thank you i wasnt paying attention sorry

[maddog39]

Its been like 1 or 2 days and I have 20 credits from my original starting 3, lol.

[Xedos]

What? Your giving out hosting credits?

Your nice.

*Cough*Isaidyournicenowgiveme5000credits*Cough*