Testing PHP form injection

Question

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input:

if( $_POST["var"] != "" ) {
    print "Current value: ".$_POST["var"]."\n";
}

But if I try to inject PHP code ("; print phpinfo();, " etc.) I just get it echoed back to me instead of executing it.

I'm aware of how to clean the input using htmlspecialchars, addcslashes, mysqli_real_escape_string etc. but before I use them - what syntax do I need to successfully inject arbitrary PHP code?

I have noticed that my machine has the PHP Suhosin patch installed (Ubuntu 10.10) - would that be auto-escaping/sanitising my input for me?

Answer 1

For that code, I wouldnt expect to get PHP injection, but I'd look at Cross-Site Scripting (XSS) instead.

For example, try injecting:

<script> alert('woot Security.SE rulez!');</script>

Answer 2

"PHP Injection" isn't possible unless your application is using include(), require(), eval(), create_function(), or any of those similar functions that invoke the interpreter. Or if your application writes out to files in PHP's path that end with .php, .phtml, or any other PHP registered file extensions.

As pointed out by AviD, though, markup and script injection are definitely possible in your example.

Try downloading "Tamper Data"... it's an Add-on for Firefox that it makes laughably easy to perform injection attacks against a web application. It even has some built-in default attacks that you can try, in case you're not aware of any yourself!