Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below.

$id = intval($_REQUEST['id']);

$result = mysql_query("SELECT * FROM newsevent where id = '$id' order by id DESC");

Example the website link is

mysite.com/newsview.php?id=30 

I put the ' symbol at the end of the url. It will return error

 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''30''' at line 1 SELECT * FROM newsevent where id = '30''.

This is the full code of newsview.php

<?php
    $page="video"; 
    require('include/header.php'); 
    require('include/config.php');
    $id = intval($_REQUEST['id']);

    $result = mysql_query("SELECT * FROM newsevent where id = '$id' order by id DESC");
?>
<div id="fb-root"></div>
<script>(function(d, s, id) {
  var js, fjs = d.getElementsByTagName(s)[0];
  if (d.getElementById(id)) return;
  js = d.createElement(s); js.id = id;
  js.src = "//connect.facebook.net/en_GB/all.js#xfbml=1&appId=306364829393363";
  fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>

<script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="https://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script>


    <section id="wrappermain">
        <div class="wrapper">


            <div class="gray-top">&nbsp;</div>
            <div class="content">

                        <!--------- Bradcrum ------- -->
                <div class="bradcum">
                <?php 
                            $query5 = "SELECT * FROM newsevent where id = '$id'";
                            $result5 = mysql_query($query5) or die (mysql_error() . ' ' .$query5);

                            while($row5 = mysql_fetch_assoc($result5)) {

                ?>

                <h2> <a href="news.php" style="font-size:16px;">News and Events </a> &raquo; <a style="font-size:16px;"><?php echo $row5['title']; ?> </a> </h2> <p>

                <?php } ?>
                </div>
                <!-- ------------ -->

                <div id="newsevent">
                    <?php
                        while($row = mysql_fetch_assoc($result))
                        {
                            $no+= 1;

                    ?>

                    <div><h2><?php echo $row['title']; ?></h2>    </div>        
                <!--    <div>  <img src = "images/newsandevent/<?php //echo $row['image']; ?>" style = "height: 344px; width: 630px;" />  </div> -->
                    <div class="disp">  <?php echo $row['de']; ?>  </div>


                    <?php } ?>
                    <!--<div class="sharess"> 

                    <div class="fb-like" data-href="http://mysite.com/newsview.php?id=<?php echo $id; ?>" data-send="true" data-width="200" data-show-faces="false"></div> 

                    <a href="https://twitter.com/share" class="twitter-share-button" data-url="http://mysite.com/newsview.php?id=<?php echo $id; ?>" data-via="Atul_33" data-lang="en">Tweet</a>
                    </div>-->
            <!-- AddThis Button BEGIN -->
            <div style="width: 400px;">
            <a class="addthis_button" href="http://www.addthis.com/bookmark.php?v=300&amp;pubid=ra-50f6428f0c05d757"><img src="http://s7.addthis.com/static/btn/v2/lg-share-en.gif" width="160" height="20" alt="Bookmark and Share" style="border:0"/></a>
            <script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-50f6428f0c05d757"></script>
            <div class="addthis_toolbox addthis_default_style">
             <a class="addthis_button_facebook_send"></a> 
            </div>
            </div> 

            <!-- AddThis Button END -->
                </div>

                 <div class="right" style="margin-top:40px;">
                    <div class="white-lt">
                    <div class="white-rt"></div>
                        <div class="white-m">

                           <strong> Recent News & Events</strong>
                            <?php $result = mysql_query("SELECT * FROM newsevent order by id DESC");
                            while($row = mysql_fetch_assoc($result))
                            {
                            ?>
                            <div><ul><li><a href = "newsview.php?id=<?php echo $row['id']; ?>"> <?php echo $row['title']; ?></li></ul> </a></div>   
                            <?php } ?> 

                          </div>
                    <div class="white-lb">
                    <div class="white-rb"></div> 
                 </div>   
                </div>
                </div>


            </div>

             <div class="gray-bot">&nbsp;</div>
        </div>
    </section>
    <?php 
    require('include/footer.php'); 
?>

Another thing that make me feel confius, why the code below come from file viewworkshop.php is not vulnerable to sql injection.The query structure is same like the code above.

This is the full code for viewworkshop.php.It also have the code $id = intval($_REQUEST['id'])

    <?php
    $page="workshops"; 
    require('include/config.php');
    require('include/header.php'); 
    $id = intval($_REQUEST['id']);
?>
<div id="fb-root"></div>
<script>(function(d, s, id) {
  var js, fjs = d.getElementsByTagName(s)[0];
  if (d.getElementById(id)) return;
  js = d.createElement(s); js.id = id;
  js.src = "//connect.facebook.net/en_GB/all.js#xfbml=1&appId=306364829393363";
  fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>

<script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="https://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script>

    <section id="wrappermain">
        <div class="wrapper">


            <div class="gray-top">&nbsp;</div>
            <div class="content">


            <?php
                $query = "select * from workshop where id = '$id'";
                $result = mysql_query($query) or die (mysql_error() . ' ' .$query);
                while($row = mysql_fetch_assoc($result)) { ?>
            <div class="content-left">
                <h2><?php echo $row['headline']; ?></h2>
                    <artical>
                        <?php echo $row['details']; ?>
                    </artical>

                    <!--<div class="sharess"> 

                    <div class="fb-like" data-href="http://mysite.com/viewworkshop.php?id=<?php echo $id; ?>" data-send="true" data-width="200" data-show-faces="false"></div> 

                    <a href="https://twitter.com/share" class="twitter-share-button" data-url="http://mysite.com/viewworkshop.php?id=<?php echo $id; ?>" data-via="Atul_33" data-lang="en">Tweet</a>
                    </div>-->

            <!-- AddThis Button BEGIN -->
            <div style="width: 400px;">
            <a class="addthis_button" href="http://www.addthis.com/bookmark.php?v=300&amp;pubid=ra-50f6428f0c05d757"><img src="http://s7.addthis.com/static/btn/v2/lg-share-en.gif" width="160" height="20" alt="Bookmark and Share" style="border:0"/></a>
            <script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-50f6428f0c05d757"></script>
            <div class="addthis_toolbox addthis_default_style">
             <a class="addthis_button_facebook_send"></a> 
            </div>
            </div> 

            <!-- AddThis Button END -->

            </div>
            <div class="content-right">
                <div class="module_white">
                    <h2>Dates</h2>
                    <p><?php echo $row['start_date']; ?> and <?php echo $row['end_date']; ?></p>
                </div>
                <div class="module_white">
                    <h2>Location </h2>
                    <p><?php echo $row['address']; ?></p>
                </div>
                <div class="module_white">
                    <h2>Timings</h2>
                    <p><?php echo $row['start_time']; ?> to <?php echo $row['end_time']; ?>.</p>
                </div>
                <div class="module_white">
                    <h2>Maximum Seats</h2>
                    <p><?php echo $row['seats']; ?></p>
                </div>

                <div class="module_white">
                    <h2>Prerequisites</h2>
                    <p><?php echo $row['prerequisites']; ?></p>

                </div>
                <div class="module_white">
                    <h2>Join The Workshop</h2>
                    <p><?php echo $row['registration']; ?></p>
                </div>
                <div class="module_white">
                    <h2>Participation Fee</h2>
                    <p><?php echo $row['cost']; ?></p>
                </div>

            </div>
<?php } ?>

                    </div>





             <div class="gray-bot">&nbsp;</div>

        </div>

    </section>


 <?php 
    require('include/footer.php'); 
?>
share|improve this question
    
The different behaviour between the two pages might be due to including config.php and header.php in a different order in each page. –  davidwebster48 Oct 31 '13 at 10:45
    
You also have HTML-injection (potential XSS) from echoing out row data without htmlspecialchars(). –  bobince Oct 31 '13 at 11:20
    
The whole idea of using $_REQUEST is somehow wrong. Note that it contains the content of $_POST, $_GET and $_COOKIE. Just specify which method you want to use/receive. –  HamZa Nov 8 '13 at 18:34

2 Answers 2

Strictly speaking, yes you are correct, using intval should prevent sql injection. But note that using mysql_query is not considered a safe way to perform queries within PHP.

This example is still relatively simple, but more complex queries containing strings might not be that easy to sanitize yourself. You should be using either MySQLi, PDO or an ORM.

$stmt = $db->prep_stmt("SELECT * FROM newsevent where id = $id");

/* Binding 2 parameters. */
$stmt->bind_param("i", $id);

$userid = $_REQUEST['id'];


/* Executing the statement */
$stmt->execute( ) or die ("Could not execute statement");
share|improve this answer
    
The mysql_ functions are deprecated, but I disagree that that they are inherently unsafe - the client side binding in PDO uses mysql[i]_real_sescape_string. Prepare statements, particularly with PDO are not a miracle solution and have some nasties waiting to catch the unwary –  symcbean Oct 31 '13 at 9:23
    
The functions aren't unsafe, the problem is people do not sanitize their variables enough. I advice against using mysql_ functions because there are frameworks which are designed to cover as much of the gotchas as possible. But that's just my opinion. –  Lucas Kauffman Oct 31 '13 at 9:30

The error that you get is by putting two ' around the id which is the number take them off.

It should be this:

SELECT * FROM newsevent where id = $id

You cant inject sql injection. It will return 0 if it fails (if it is not a number).

With numbers going in, no injection is possible

share|improve this answer
    
already edit to SELECT * FROM newsevent where id = $id. Still return error when i insert the ' symbol in the url. –  zer0fl4g Oct 31 '13 at 6:13
    
Try this. put first: OR 1=1-- . see if no error is returned. If there is no error..your code is vulnerable to SQL injection –  Kratos Oct 31 '13 at 8:16
    
Setting id to something like (SELECT id FROM user WHERE user.name LIKE '%admin%' ORDER BY id ASC LIMIT 1) will lead to SELECT * FROM newsevent where id = (SELECT id FROM user WHERE user.name LIKE '%admin%' ORDER BY id ASC LIMIT 1) ORDER BY id DESC which is sqlinj. This is a mostly useless example, but you get the point. –  НЛО Oct 31 '13 at 9:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.