Re: Question on SQLinjection and XSS


JuergenRiemer schreef:
On Jul 10, 10:45 am, Erwin Moller
<Since_humans_read_this_I_am_spammed_too_m...@xxxxxxxxxxxxxxxx> wrote:
Petra Meier schreef:
Hi,

I do seriously not want to be pedantic, but here we go:

Are you sure you are using the right words here?
CRUD: Create (=insert), R(ead) (=SELECT), U(pdate), D(elete).
You are only running your 2 methods on the Create, and probably also
when you Update. You do not use them for Delete or Select I expect.
Try to avoid jargon especially when is inappropriate jargon.

I used "i.e." in my first post

create: $query = "insert into users set username = '".$username."'";
read: $query = "select username from users where id=".$uid;
update: $query = "update users set username='".$username."' where id=".
$uid;
delete: $query = "delete from users where id=".$uid;

Futhermore: If you ask "is there still a security hole", you don't
really appreciate what security is all about. For starters, how can we
tell what securityholes you might be having if we don't know the first
thing about your application, the OS it is running on, the PHPversion
you are using, etc. etc.

I have seen this attitude many times, and for your own sake I want to
warn you for it.
What attitude?
This one: "I heard of security, and some things about SQL injection,
XSSattacks, but I do not have the time to investigate them seriously, so
I made a function I call 'sanitize()' that I call whener I need 'security'."
I see that attitude on a regular basis, and the funpart is they all call
it sanitize() as if that solves your securitytroubles.
It doesn't.
You must make sure you dive into the gory details yourself. Try to hack
your own application. Understand each and every function you are using
and understand WHY you use it. If you are serious about it, you must
also dive into the gory details of the OS you are using.
That is the only way to make a remotely secure application.
Not a function called 'sanitize()'.


Hi again,

perhaps I was not clear enough, so here is my question again:

Yes, you were clear. :-)


I have a php script that produces SQL strings (like the 4 ones above).
Even with my level of IT knowledge I know that the variables are entry
points for all sorts of malicious attacks such as SQL injections and
bad data that when printed out to the webpage will execute client side
scripts. so I validate (sanitize) these variables to close this hole.
My humble question was if with the following method calls

$savevalue =
mysql_real_escape_string(htmlspecialchars($unsafevalue));

If you expect an integer (line an id) I simply use:
$userid = (int)$_POST["userid"];

If you expect a string, use something like mysql_real_escape_string().

If you want to protect yourself against XXS (or Javascript in general), you have at least 2 sensible options:
1) call the appropriate functions when you DISPLAY the data, like Jerry pointed out. So store it 'raw' in the database, and when you pull it out later for display in a webpage, pass them through the appropriate functions, like htmlspecialchars().
2) Strip all javascript (or all HTML markup, or whatever suits your needs) BEFORE inserting it into the database.

Why do we advise you NOT to store your strings in a database with htmlspecialchars?
Because you are storing something else than the original data. You store processed data: processed for use in HTML.
It is just more 'natural' to store the original data, and process it the right way at the right place.

This might seem like a unimportant point maybe, but think about an export you might need in the future (CSV or XML or whatever) that needs the original plaintext. Then you are stuck with your html-charaters instead of original data.
Or a search for certain characters in the table.
(Of course you could convert them back).

In the end it is of course your own choice. :-)
Most programmers I know prefer having 'real data' in the database, and process it when needed in a way that is apropriate for that task. So only use htmlspecialchars when you produce the actual html.



I achieve this goal? Or is there a better way to check/validate/
sanitize user input?

If sanitize means no SQL attacks, then yes.
If you want to prevent XSS, I think yes, but I am not 100% sure.
(I am not 100% sure because I have just been reading about sofisticated XSS vectors. So I won't give you advise.)
But this is good place to start reading.
http://en.wikipedia.org/wiki/Cross-site_scripting


I also do know that security as such encompasses a lot more issues,
yet this was not my question.

That's OK.
I/we just want to warn you for a false sense of security. :-)

Good luck and regards,
Erwin Moller


thanks
pm


.

Relevant Pages

  • Re: Securely accessing an Access 2007 database...and are Access 2007 databases secure?
    ... the password, than it is to keep out security professionals, police, etc. ... find the password to my database in plaintext. ... than pulling out strings and trying to figure out what they mean. ... A 'solution' would be to store the password to the database encrypted ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Securely accessing an Access 2007 database...and are Access 2007 databases secure?
    ... People don't want serious security on their office documents and simple databases - for most people it is more important to ensure that they can recover their data when they forget the password, than it is to keep out security professionals, police, etc. ... find the password to my database in plaintext. ... That would be the way I would attack your program - it's much easier than pulling out strings and trying to figure out what they mean. ... A 'solution' would be to store the password to the database encrypted with a key based on the user's password. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Links and graphics in Access
    ... Just store the file name in the database, then on your page create a relative path to the location ... Never heard of an security issues related to storing hyperlink in a database. ...
    (microsoft.public.frontpage.client)
  • Re: Database on windows ce
    ... A DB engine would make it simpler to ... All i need the database is to store some data. ... possible to have some sort of security for databases wherein everyone ...
    (microsoft.public.windowsce.embedded)
  • Re: Create new database
    ... > original data on file. ... >> I am trying to make a Resume Database. ... I want to store these resumes and be able to do ... > Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se ...
    (microsoft.public.sqlserver.programming)