Reply to thread

Message

<blockquote data-quote="CosmoPeak" data-source="post: 391419" data-attributes="member: 68352">If you've used this code, you need to be careful. $_GET['id'] hasn't been sanitised (someone could write SQL in the id parameter and it would be ran directly on your database - look up SQL injection). [USER=57721]@Nicholas[/USER] is partially correct, but simply using MySQLi or PDO doesn't make you immune to SQL injection. You can still use MySQLi/PDO in the same way you can use MySQL. What they should be suggesting is using prepared statements. I looked at a CMS advertised as 'MySQLi' recently which just used MySQLi's query function and still escaped the parameters manually. This is not good practice and not what &quot;use MySQLi or PDO&quot; means at all.In any case, you need to sanitise the user input. Here's an example if you're using RevCMS:(I've changed the first few lines and changed the variable in the MySQL query from $_GET['id'] to $news_id)[code=php]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &lt;?php&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; global $engine;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $news_id = 1; // Default value&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(isset($_GET['id']) &amp;&amp; is_numeric($_GET['id']))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $news_id = $engine-&gt;secure($_GET['id']); // Sanitised input&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $author = mysql_fetch_array(mysql_query(&quot;SELECT author FROM cms_news WHERE id = &quot; . $news_id)); // Use the sanitised and SQL-injection free value&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $a = mysql_fetch_array(mysql_query(&quot;SELECT * FROM users WHERE id = &quot;.$author['author']));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $look = $a['look'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $user = $a['username'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo '&lt;div id=&quot;userAvatar&quot; style=&quot;margin-bottom: 10px;;float:left;width: 75px;height:70px;background: url(http://avatar-retro.com/habbo-imaging/avatarimage?figure='.$look.'&amp;amp;action=drk&amp;amp;direction=3&amp;amp;head_direction=3&amp;amp;gesture=sml&amp;amp;size=1) no-repeat;&quot;&gt;&lt;/div&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;div id=&quot;slickTitle&quot; style=&quot;margin-top:17px;&quot; class=&quot;newsAuthor&quot;&gt;&lt;a href=&quot;/home/'.$user.'&quot; style=&quot;text-decoration:none;color:#666;&quot;&gt;'.$user.'&lt;/a&gt;&lt;span class=&quot;newstext&quot;&gt;&lt;b&gt;{newsDate}&lt;/b&gt;&lt;/span&gt;&lt;/div&gt;';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ?&gt;[/code]</blockquote>

[QUOTE="CosmoPeak, post: 391419, member: 68352"] If you've used this code, you need to be careful. $_GET['id'] hasn't been sanitised (someone could write SQL in the id parameter and it would be ran directly on your database - look up SQL injection). [USER=57721]@Nicholas[/USER] is partially correct, but simply using MySQLi or PDO doesn't make you immune to SQL injection. You can still use MySQLi/PDO in the same way you can use MySQL. What they should be suggesting is using [I]prepared statements[/I]. I looked at a CMS advertised as 'MySQLi' recently which just used MySQLi's query function and still escaped the parameters manually. This is not good practice and not what "use MySQLi or PDO" means at all. In any case, you need to sanitise the user input. Here's an example if you're using RevCMS: (I've changed the first few lines and changed the variable in the MySQL query from $_GET['id'] to $news_id) [code=php] <?php global $engine; $news_id = 1; // Default value if(isset($_GET['id']) && is_numeric($_GET['id'])) $news_id = $engine->secure($_GET['id']); // Sanitised input $author = mysql_fetch_array(mysql_query("SELECT author FROM cms_news WHERE id = " . $news_id)); // Use the sanitised and SQL-injection free value $a = mysql_fetch_array(mysql_query("SELECT * FROM users WHERE id = ".$author['author'])); $look = $a['look']; $user = $a['username']; echo '<div id="userAvatar" style="margin-bottom: 10px;;float:left;width: 75px;height:70px;background: url(http://avatar-retro.com/habbo-imaging/avatarimage?figure='.$look.'&action=drk&direction=3&head_direction=3&gesture=sml&size=1) no-repeat;"></div> <div id="slickTitle" style="margin-top:17px;" class="newsAuthor"><a href="/home/'.$user.'" style="text-decoration:none;color:#666;">'.$user.'</a>{newsDate}</div>'; ?> [/code] [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members