didou Sun Mar 21 11:45:37 2004 EDT
Modified files:
/phpdoc/en/security database.xml
Log:
adding php tags
http://cvs.php.net/diff.php/phpdoc/en/security/database.xml?r1=1.2&r2=1.3&ty=u
Index: phpdoc/en/security/database.xml
diff -u phpdoc/en/security/database.xml:1.2 phpdoc/en/security/database.xml:1.3
--- phpdoc/en/security/database.xml:1.2 Wed Feb 18 12:09:16 2004
+++ phpdoc/en/security/database.xml Sun Mar 21 11:45:37 2004
@@ -1,5 +1,5 @@
<?xml version="1.0" encoding="iso-8859-1"?>
-<!-- $Revision: 1.2 $ -->
+<!-- $Revision: 1.3 $ -->
<!-- splitted from ./index.xml, last change in rev 1.66 -->
<sect1 id="security.database">
<title>Database Security</title>
@@ -117,6 +117,8 @@
<title>Using hashed password field</title>
<programlisting role="php">
<![CDATA[
+<?php
+
// storing password hash
$query = sprintf("INSERT INTO users(name,pwd) VALUES('%s','%s');",
addslashes($username), md5($password));
@@ -133,6 +135,8 @@
else {
echo "Authentication failed for $username.";
}
+
+?>
]]>
</programlisting>
</example>
@@ -166,12 +170,16 @@
</title>
<programlisting role="php">
<![CDATA[
+<?php
+
$offset = argv[0]; // beware, no input validation!
$query = "SELECT id, name FROM products ORDER BY name LIMIT 20 OFFSET $offset;";
// with PostgreSQL
$result = pg_exec($conn, $query);
// with MySQL
$result = mysql_query($query);
+
+?>
]]>
</programlisting>
</example>
@@ -224,10 +232,14 @@
</title>
<programlisting role="php">
<![CDATA[
+<?php
+
$query = "SELECT id, name, inserted, size FROM products
WHERE size = '$size'
ORDER BY $order LIMIT $limit, $offset;";
$result = odbc_exec($conn, $query);
+
+?>
]]>
</programlisting>
</example>
@@ -260,7 +272,9 @@
</title>
<programlisting role="php">
<![CDATA[
+<?php
$query = "UPDATE usertable SET pwd='$pwd' WHERE uid='$uid';";
+?>
]]>
</programlisting>
</example>
@@ -272,11 +286,16 @@
<informalexample>
<programlisting role="php">
<![CDATA[
+<?php
+
// $uid == ' or uid like'%admin%'; --
$query = "UPDATE usertable SET pwd='...' WHERE uid='' or uid like '%admin%'; --";
// $pwd == "hehehe', admin='yes', trusted=100 "
-$query = "UPDATE usertable SET pwd='hehehe', admin='yes', trusted=100 WHERE ...;"
+$query = "UPDATE usertable SET pwd='hehehe', admin='yes', trusted=100 WHERE
+...;";
+
+?>
]]>
</programlisting>
</informalexample>
@@ -288,8 +307,12 @@
<title>Attacking the database hosts operating system (MSSQL Server)</title>
<programlisting role="php">
<![CDATA[
+<?php
+
$query = "SELECT * FROM products WHERE id LIKE '%$prod%'";
$result = mssql_query($query);
+
+?>
]]>
</programlisting>
</example>
@@ -299,10 +322,14 @@
<informalexample>
<programlisting role="php">
<![CDATA[
+<?php
+
$query = "SELECT * FROM products
WHERE id LIKE '%a%'
exec master..xp_cmdshell 'net user test testpass /ADD'--";
$result = mssql_query($query);
+
+?>
]]>
</programlisting>
</informalexample>
@@ -369,12 +396,16 @@
<title>A more secure way to compose a query for paging</title>
<programlisting role="php">
<![CDATA[
+<?php
+
settype($offset, 'integer');
$query = "SELECT id, name FROM products ORDER BY name LIMIT 20 OFFSET $offset;";
// please note %d in the format string, using %s would be meaningless
$query = sprintf("SELECT id, name FROM products ORDER BY name LIMIT 20 OFFSET %d;",
$offset);
+
+?>
]]>
</programlisting>
</example>
