At 09:31 AM 8/15/2007, you wrote:
The standard mysql_x() functions do not allow multiple queries, so
you're not so worried about someone injecting drop table statements.
Nevertheless, plenty of damage and/or disclosure can be performed with
just a single query.
Just to emphasize and elaborate on Chris's point here, a query like this:
SELECT * FROM `jobsdb` WHERE `id`=1; DROP `jobsdb`
when it is sent to MySQL via mysql_query() or one of the other mysql
functions, will NOT execute the command following the semicolon. It
will however of course work if you are submitting it in the MySQL
Monitor or phpMyAdmin, because it is in fact a valid MySQL
instruction (actually, two of them).
But consider a query like this:
DELETE FROM `jobsdb` WHERE `id`=1 OR 1=1
where the 1 OR 1=1 is user input (rather than the expected 1 or 2 or
whatever). In this case, Chris's "plenty of damage" is possibly an
understatement, since this query will in fact be executed and all
rows will be deleted. In a case like this, you need to be checking
that your user is entering an expected kind of value, that is (in
this case), an integer, with the is_int() function, or (in other
cases) however you can.
The point is that you can't just rely on mysql_real_escape_string for
protection.
Michael Southwell, Vice President for Education
New York PHP
http://www.nyphp.com/training - In-depth PHP Training Courses
_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk
NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com
Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php
