Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: TWIG SQL query bugs
From: "Ryan Fox" <rfox () noguska com>
Date: Wed, 30 May 2001 15:51:59 -0400

One more point here.

Simply adding a quote is not the proper way to handle this in PHP.

Not really.  There are other malicious characters that can be used in sql
statements.  The one in the front of my mind is ";", used to terminate a
query and begin a new one.  Think of $IDNumber=";drop database foo".  (This
can be helped by using a database with proper access controls set up, so the
user the web process normally connects as does not have permission to drop a
database.  I don't know if this product sets itself up like that by
default).

Good programming practice is to code a function specifically to strip any
possible malicious characters out of strings, and wrap it around every
variable put into a query, whether it should be user-supplied or not.
Addslashes is a good function to call from your stripping function, but it
should not be your only line of defense.

Ryan Fox



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]