Getting info from the database...

PHP programming forum. Ask questions or help people concerning PHP code. Don't understand a function? Need help implementing a class? Don't understand a class? Here is where to ask. Remember to do your homework!

Moderator: General Moderators

josh
DevNet Master
Posts: 4872
Joined: Wed Feb 11, 2004 3:23 pm
Location: Palm beach, Florida

Post by josh »

No that is not what we mean, we mean something like:

Code: Select all

$admin = 0;
mysql_query("INSERT INTO `users` (`username`, `password`, `admin`) VALUES ('$username', '$password', '$admin')");
Someone could set admin to 1 by sending this as their password:

Code: Select all

foobar', '1')--
Put that in place of $password and you'll see what I mean, that is called SQL injection and we have already discussed that in this thread. In case you're wondering the -- tells mysql to ignore the rest of the query. mysql_real_escape_string would have replaced the quote after foobar with a \' which tells mysql that the quote is to be part of the password itself.

Also you should have a limit on the username length in addition to this, as you can see this exploit is less then 25 characters and gives the attacker admin access
User avatar
No0b
Forum Commoner
Posts: 37
Joined: Tue Feb 07, 2006 6:17 pm

Post by No0b »

But I don't want the password to have ', ", \, /, or anyothers. How will I do this?

Edit:

I put

Code: Select all

foobar', '1')--
in my username and I don't see what it did??? it just turns out looking like

Hello foobar\', \'1\')--! Log Out

what's it suppose to do???
josh
DevNet Master
Posts: 4872
Joined: Wed Feb 11, 2004 3:23 pm
Location: Palm beach, Florida

Post by josh »

You need to use preg_match() to limit the password to certain characters and lengths
User avatar
a94060
Forum Regular
Posts: 543
Joined: Fri Feb 10, 2006 4:53 pm

Post by a94060 »

u might be able to,but that does not prevent the input of tags like <br> or any others. It mayalso allow other powerful scripts such as asp or PHP and java to acces ur server. This may cause unwanted info to be displayed.
User avatar
feyd
Neighborhood Spidermoddy
Posts: 31559
Joined: Mon Mar 29, 2004 3:24 pm
Location: Bothell, Washington, USA

Post by feyd »

who are you responding to a94060?
Post Reply