Difference between revisions of "CRV2 SQLInjPHP"

From OWASP
Jump to: navigation, search
Line 14: Line 14:
 
It is as simple as this the absence of data validation and prepared statements or stored procedures will increase the possibility that your code contain SQL injections.
 
It is as simple as this the absence of data validation and prepared statements or stored procedures will increase the possibility that your code contain SQL injections.
 
If your application gives the users the possibility to change parameters and those parameters are not verified and inserted
 
If your application gives the users the possibility to change parameters and those parameters are not verified and inserted
in an unprepared statement than your code contain an SQL Injection
+
in an unprepared statement than your code contain an SQL Injection.
""Example 1 :""
+
Example 1 :
<?php
+
<?php
$a=$_GET["a"];
+
$a=$_GET["a"];
$con = mysql_connect('localhost', 'owasp', 'abc123');
+
$con = mysql_connect('localhost', 'owasp', 'abc123');
mysql_select_db("owasp_php", $con);
+
mysql_select_db("owasp_php", $con);
$sql="SELECT * FROM user WHERE id = '".$a."'";
+
$sql="SELECT * FROM user WHERE id = '".$a."'";
$result = mysql_query($sql);
+
$result = mysql_query($sql);
?>
+
?>
  
 
==Business Validation==
 
==Business Validation==

Revision as of 21:19, 15 October 2013

««Reviewing code for SQL Injection«« Main
(Table of Contents)
»»CRV2 SQL Injection Java»»

Contents


Introduction

An SQL injection Attack consists of injecting sql query portions in the back-end database system via the client interface in the web application. The consequence of a successful exploitation of an SQL injection varies from just reading data to modifying data or executing system commands. SQL Injection in PHP remains the number one attack vector, and also the number on reason for DATA COMPROMISES

Data Validation and prepared statements

It is as simple as this the absence of data validation and prepared statements or stored procedures will increase the possibility that your code contain SQL injections. If your application gives the users the possibility to change parameters and those parameters are not verified and inserted in an unprepared statement than your code contain an SQL Injection. Example 1 :

<?php
$a=$_GET["a"];
$con = mysql_connect('localhost', 'owasp', 'abc123');
mysql_select_db("owasp_php", $con);
$sql="SELECT * FROM user WHERE id = '".$a."'";
$result = mysql_query($sql);
?>

Business Validation

Business validation is concerned with business logic. An understanding of the business logic is required prior to reviewing the code which performs such logic. Business validation could be used to limit the value range or a transaction inputted by a user or reject input which does not make too much business sense. Reviewing code for business validation can also include rounding errors or floating point issues which may give rise to issues such as integer overflows which can dramatically damage the bottom line.

Canonicalization

Canonicalization is the process by which various equivalent forms of a name can be resolved to a single standard name, or the "canonical" name.

The most popular encodings are UTF-8, UTF-16, and so on (which are described in detail in RFC 2279). A single character, such as a period/full-stop (.), may be represented in many different ways: ASCII 2E, Unicode C0 AE, and many others.

With the myriad ways of encoding user input, a web application's filters can be easily circumvented if they're not carefully built.

Bad Example

public static void main(String[] args) {
    File x = new File("/cmd/" + args[1]);
    String absPath = x.getAbsolutePath();
}

Good Example

public static void main(String[] args) throws IOException {
    File x = new File("/cmd/" + args[1]);
    String canonicalPath = x.getCanonicalPath();
}


References

See Reviewing code for Data Validation (in this guide) Reviewing code for Data Validation


See the OWASP ESAPI Project

The OWASP ESAPI project provides a reference implementation of a security API which can assist in providing security controls to an application.


««Session Management«« Main
(Table of Contents)
»»Error Handling»»