1

I am building a website, and I was wondering what would happen if I left my $_GET command unsanitized in some simple case like this:

<?php
if (isset($_GET['example'])) {
    $object_name = $_GET['example'];
}else{
    header( 'Location: ./index.php');
    exit();
}
echo $object_name;
?>

Where I am taking some input for the url www.example.com/file.php?example=30 Is there anything I could replace 30 with that would give me access to write code directly onto the website's backend, or other bad things?

Also, if I didn't have print there but instead passed that variable to something more complicated, is there any risk to leaving it unsanitized? What is the best sanitation method? Would htmlentities() stop everything?

1
  • Welcome to security.SE. This question seems way too broad, so I am voting to close. You can't defend against all (or any, really) attacks via input sanitation, you need proper defenses in place, which depend on where you use the input (eg context-dependend encoding for defense against XSS, prepared statements for SQL injection, and so on).
    – tim
    Feb 13, 2017 at 21:19

3 Answers 3

3

What your example basically does is echoing back whatever you give it. That means that an attacker could craft a link with some content in the URL, and whoever clicks the link will be served the content the attacker chose.

So how can that be used, other than to mildly embarass you? That depends on the content type. Since nothing else is specified I asume that it is text/html. If an attacker can serve HTML, she can also serve scripts that will be run in the browser as if they were from your origin. This in turn means that the script could e.g. steal authentications cookies, keylog passwords or perform actions on behalf of the victim. What you have here is a prime example of reflected XSS, and that is very, very bad.

But could the attacker run code on the backend, i.e. the server? No, not directly. The response is sent to the client, after all. But this could be used as a spring board for privelige escalation that could easily lead to remove code execution if there is some kind of weakness in whatever webapp you are using that e.g. lets administrators modify PHP code.

So how do you sanitize? That is a question to broad to answer in full here, but let me at least say this: htmlentities() will protect you in some cases but not all. To understand when it is useful and why, read its documentaiton and the OWASP XSS prevention cheat sheet.

As pointed out in Tom's answer, doing other stuff with the unsanitized data will lead to other problems, e.g. SQL injection if you use it in SQL queries.

2

Problematic is what happens to that variable later on in the code.

If it is being used for a SQL Query, you might be vulnerable for a SQL injection.

If you echo the variable, script could be added to the url which is being executed then.

I would recommend htmlspecialchars() for PHP sanitation and mysqli_real_escape_string/ prepare statements for sanitation for DB queries

2
  • Could you give me a simple example of how I would put a script to the url that would then be executed in the code? I tried a few, but none of them worked so that's why I came here. Although I know almost nothing about injection so I was probably doing it wrong.
    – user139270
    Feb 13, 2017 at 20:53
  • 2
    mysqli_real_escape_string really isn't the recommended approach to SQL injection. I'm also not sure what you mean by "PHP sanitation", and htmlspecialchars is only appropriate against XSS in some contexts (the example from the OP would be one of those).
    – tim
    Feb 13, 2017 at 21:22
0

Don't trust user input. According to your code you did not santized the value of $_GET. So it is highly vulnerable and it can lead many type vulnerability like LFI, RFI, RCE.

You must log in to answer this question.