Re: PHP filter function against SQL injections

[jeffrey rivero <jeffr76 () yahoo com>]

also a union  could be an issue depending on the location of the union
ie.

$myval = pastvar['post']
$sql = 'select a, b, c';
$sql .= 'From table_1';
$sql .= 'where a = ' . filter($myval);
now if i entered this in the post_var
$myval = "1 union all select a,b,c from table_1";
what would happend :)
our results would not be ideal
:)
hope this helped
ps. you might also want to look at the xml i sent
this is the SQL injection project i created a while ago its by no means 
100% but should get you to about 70% ish
so the work now
formula
D(WS)*[RW](WS)*D
Where :
   D  : deliminator
   WS : White Space
   RW : Reserve Word
        RW can be in two types
          Literal       : Standard string like "SELECT" or "SELECT TOP"
          parameterized : Strings that allow subistition like "xp_*" 
which would
                            find any string that starts with a "xp_"
                            Note :  the * can be anyware in the 
Parameterized  String
                                  Like "SELECT*FROM"

and i load it with an XML file something like
  <KeyWords>
      <KeyWord Type="parameterized">SELECT*FROM</KeyWord>
      <KeyWord Type="Literal">UNION</KeyWord>
      <KeyWord Type="Literal">INSERT INTO</KeyWord>
      <KeyWord Type="Literal">DROP DATABASE</KeyWord>
      <KeyWord Type="Literal">DROP CUBE</KeyWord>
      <KeyWord Type="Literal">DROP FUNCTION</KeyWord>
      <KeyWord Type="Literal">DROP INDEX </KeyWord>
      <KeyWord Type="Literal">DROP PROCEDURE</KeyWord>
      <KeyWord Type="Literal">DROP TABLE</KeyWord>
      <KeyWord Type="Literal">DROP TRIGGER</KeyWord>
      <KeyWord Type="Literal">DROP VIEW</KeyWord>
      <KeyWord Type="Literal">ALTER DATABASE</KeyWord>
      <KeyWord Type="Literal">ALTER CUBE</KeyWord>
      <KeyWord Type="Literal">ALTER FUNCTION</KeyWord>
      <KeyWord Type="Literal">ALTER PROCEDURE</KeyWord>
      <KeyWord Type="Literal">ALTER TABLE</KeyWord>
      <KeyWord Type="Literal">ALTER TRIGGER</KeyWord>
      <KeyWord Type="Literal">ALTER VIEW</KeyWord>
      <KeyWord Type="Literal">CREATE DATABASE</KeyWord>
      <KeyWord Type="Literal">CREATE CUBE</KeyWord>
      <KeyWord Type="Literal">CREATE FUNCTION</KeyWord>
      <KeyWord Type="Literal">CREATE INDEX </KeyWord>
      <KeyWord Type="Literal">CREATE PROCEDURE</KeyWord>
      <KeyWord Type="Literal">CREATE TABLE</KeyWord>
      <KeyWord Type="Literal">CREATE TRIGGER</KeyWord>
      <KeyWord Type="Literal">CREATE VIEW</KeyWord>
      <KeyWord Type="Literal">SHUTDOWN</KeyWord>
      <KeyWord Type="Literal">SELECT @@SERVERNAME</KeyWord>
      <KeyWord Type="Literal">SELECT @@DATABASE</KeyWord>
      <KeyWord Type="Literal">SELECT @@SERVICENAME</KeyWord>
      <KeyWord Type="Literal">SELECT @@VERSION</KeyWord>
      <KeyWord Type="Literal">ASCII</KeyWord>
      <KeyWord Type="Literal">DUMP DATABASE</KeyWord>
      <KeyWord Type="Literal">DUMP TRANSACTION</KeyWord>
      <KeyWord Type="Literal">BACKUP DATABASE</KeyWord>
      <KeyWord Type="Literal">BACKUP LOG</KeyWord>
      <KeyWord Type="Literal">DTS</KeyWord>
      <KeyWord Type="Literal">DBCC</KeyWord>
      <KeyWord Type="Literal">QUOTENAME</KeyWord>
      <KeyWord Type="Literal">CALL</KeyWord>
      <KeyWord Type="Literal">TRUNCATE</KeyWord>
      <KeyWord Type="Literal">CONNECT TO</KeyWord>
      <KeyWord Type="Literal">CURRENT_USER</KeyWord>
      <KeyWord Type="Literal">DB_ID</KeyWord>
      <KeyWord Type="Literal">DB_NAME</KeyWord>
      <KeyWord Type="Literal">DB_SETTIME</KeyWord>
      <KeyWord Type="Literal">GRANT</KeyWord>
      <KeyWord Type="Literal">DENY</KeyWord>
      <KeyWord Type="Literal">KILL</KeyWord>
      <KeyWord Type="Literal">PERMISSIONS</KeyWord>
      <KeyWord Type="Literal">REVOKE</KeyWord>
      <KeyWord Type="Literal">GET CONNECTION</KeyWord>
      <KeyWord Type="Literal">HAS_DBACCESS</KeyWord>
      <KeyWord Type="Literal">NO_LOG</KeyWord>
      <KeyWord Type="Literal">NO_TRUNCATE</KeyWord>
      <KeyWord Type="Literal">NO_WAIT</KeyWord>
      <KeyWord Type="Literal">OFFLINE</KeyWord>
      <KeyWord Type="Literal">ONLINE</KeyWord>
      <KeyWord Type="Literal">HOST_NAME</KeyWord>
      <KeyWord Type="Literal">PRINT</KeyWord>
      <KeyWord Type="Literal">COMPUTE</KeyWord>
      <KeyWord Type="Literal">PARTIAL</KeyWord>
      <KeyWord Type="Literal">RESTORE</KeyWord>
      <KeyWord Type="Literal">SETUSER</KeyWord>
      <KeyWord Type="Literal">begin</KeyWord>
      <KeyWord Type="Literal">end</KeyWord>
      <KeyWord Type="Literal">declare</KeyWord>
      <KeyWord Type="Literal">IS_SRVROLEMEMBER</KeyWord>
      <KeyWord Type="Literal">IS_MEMBER</KeyWord>
      <KeyWord Type="Literal">HAS_DBACCESS</KeyWord>
      <KeyWord Type="Literal">SUSER_SID</KeyWord>
      <KeyWord Type="Literal">SUSER_SNAME </KeyWord>
      <KeyWord Type="Literal">USER_ID</KeyWord>
      <KeyWord Type="Literal">sp_addlogin</KeyWord>
      <KeyWord Type="Literal">sp_grantlogin</KeyWord>
      <KeyWord Type="Literal">sp_password</KeyWord>
      <KeyWord Type="Literal">sp_ActiveDirectory_Obj</KeyWord>
      <KeyWord Type="Literal">raiserror</KeyWord>
      <KeyWord Type="Literal">1=1</KeyWord>
      <KeyWord Type="Literal">sp_makewebtask </KeyWord>
      <KeyWord Type="Literal">NULL</KeyWord>
      <KeyWord Type="Literal">OPENQUERY</KeyWord>
      <KeyWord Type="Literal">OPENROWSET</KeyWord>
      <KeyWord Type="Literal">Lock table</KeyWord>
      <KeyWord Type="Literal">PARSENAME</KeyWord>
      <KeyWord Type="parameterized">sp_*</KeyWord>
      <KeyWord Type="parameterized">XP_*</KeyWord>
      <KeyWord Type="parameterized">*_XP</KeyWord>
      <KeyWord Type="parameterized">master..*</KeyWord>
      <KeyWord Type="parameterized">master.system.*</KeyWord>
      <KeyWord Type="parameterized">master.dbo.*</KeyWord>
      <KeyWord Type="parameterized">CHAR(*)</KeyWord>
   </KeyWords>
   <WhiteSpaces>
      <WhiteSpace>#13</WhiteSpace>
      <WhiteSpace>#10</WhiteSpace>
      <WhiteSpace>#20</WhiteSpace>
   </WhiteSpaces>
   <Delimiters>
      <Deliminater>'</Deliminater>
      <Deliminater>`</Deliminater>
      <Deliminater>--</Deliminater>
      <Deliminater>"</Deliminater>
      <Deliminater>;</Deliminater>
      <Deliminater>#13</Deliminater>
      <Deliminater>#10</Deliminater>
   </Delimiters>




Kellox wrote:
> hi everyone!
>
> i was just wondering if this filter function written in php is safe against
> sql injections:
>
> function filter($string) {
>   $replace = "";
>   $search = array(">", "<", "|", ";");
>   $result = mysql_escape_string( str_replace($search, $replace, $string));
>   return $result;
> }
>
> or could anyone imagine an sql injection attack which bypasses this filter
> function?
> ___________________________________________________________________________
> mymail - der unschlagbare und kostenlose E-Mail-Dienst der Schweiz!
> http://mymail.ch/?redirect=9999
> Kaspersky Anti Virus 6.0 - So schützen Sie Ihren PC zuverlässig!
> http://ad.zanox.com/ppc/?4997698C625979254T