2

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below.

$id = intval($_REQUEST['id']);

$result = mysql_query("SELECT * FROM newsevent where id = '$id' order by id DESC");

Example the website link is

mysite.com/newsview.php?id=30 

I put the ' symbol at the end of the url. It will return error

 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''30''' at line 1 SELECT * FROM newsevent where id = '30''.

This is the full code of newsview.php

<?php
    $page="video"; 
    require('include/header.php'); 
    require('include/config.php');
    $id = intval($_REQUEST['id']);

    $result = mysql_query("SELECT * FROM newsevent where id = '$id' order by id DESC");
?>
<div id="fb-root"></div>
<script>(function(d, s, id) {
  var js, fjs = d.getElementsByTagName(s)[0];
  if (d.getElementById(id)) return;
  js = d.createElement(s); js.id = id;
  js.src = "//connect.facebook.net/en_GB/all.js#xfbml=1&appId=306364829393363";
  fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>

<script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="https://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script>


    <section id="wrappermain">
        <div class="wrapper">


            <div class="gray-top">&nbsp;</div>
            <div class="content">

                        <!--------- Bradcrum ------- -->
                <div class="bradcum">
                <?php 
                            $query5 = "SELECT * FROM newsevent where id = '$id'";
                            $result5 = mysql_query($query5) or die (mysql_error() . ' ' .$query5);

                            while($row5 = mysql_fetch_assoc($result5)) {

                ?>

                <h2> <a href="news.php" style="font-size:16px;">News and Events </a> &raquo; <a style="font-size:16px;"><?php echo $row5['title']; ?> </a> </h2> <p>

                <?php } ?>
                </div>
                <!-- ------------ -->

                <div id="newsevent">
                    <?php
                        while($row = mysql_fetch_assoc($result))
                        {
                            $no+= 1;

                    ?>

                    <div><h2><?php echo $row['title']; ?></h2>    </div>        
                <!--    <div>  <img src = "images/newsandevent/<?php //echo $row['image']; ?>" style = "height: 344px; width: 630px;" />  </div> -->
                    <div class="disp">  <?php echo $row['de']; ?>  </div>


                    <?php } ?>
                    <!--<div class="sharess"> 

                    <div class="fb-like" data-href="http://mysite.com/newsview.php?id=<?php echo $id; ?>" data-send="true" data-width="200" data-show-faces="false"></div> 

                    <a href="https://twitter.com/share" class="twitter-share-button" data-url="http://mysite.com/newsview.php?id=<?php echo $id; ?>" data-via="Atul_33" data-lang="en">Tweet</a>
                    </div>-->
            <!-- AddThis Button BEGIN -->
            <div style="width: 400px;">
            <a class="addthis_button" href="http://www.addthis.com/bookmark.php?v=300&amp;pubid=ra-50f6428f0c05d757"><img src="http://s7.addthis.com/static/btn/v2/lg-share-en.gif" width="160" height="20" alt="Bookmark and Share" style="border:0"/></a>
            <script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-50f6428f0c05d757"></script>
            <div class="addthis_toolbox addthis_default_style">
             <a class="addthis_button_facebook_send"></a> 
            </div>
            </div> 

            <!-- AddThis Button END -->
                </div>

                 <div class="right" style="margin-top:40px;">
                    <div class="white-lt">
                    <div class="white-rt"></div>
                        <div class="white-m">

                           <strong> Recent News & Events</strong>
                            <?php $result = mysql_query("SELECT * FROM newsevent order by id DESC");
                            while($row = mysql_fetch_assoc($result))
                            {
                            ?>
                            <div><ul><li><a href = "newsview.php?id=<?php echo $row['id']; ?>"> <?php echo $row['title']; ?></li></ul> </a></div>   
                            <?php } ?> 

                          </div>
                    <div class="white-lb">
                    <div class="white-rb"></div> 
                 </div>   
                </div>
                </div>


            </div>

             <div class="gray-bot">&nbsp;</div>
        </div>
    </section>
    <?php 
    require('include/footer.php'); 
?>

Another thing that make me feel confius, why the code below come from file viewworkshop.php is not vulnerable to sql injection.The query structure is same like the code above.

This is the full code for viewworkshop.php.It also have the code $id = intval($_REQUEST['id'])

    <?php
    $page="workshops"; 
    require('include/config.php');
    require('include/header.php'); 
    $id = intval($_REQUEST['id']);
?>
<div id="fb-root"></div>
<script>(function(d, s, id) {
  var js, fjs = d.getElementsByTagName(s)[0];
  if (d.getElementById(id)) return;
  js = d.createElement(s); js.id = id;
  js.src = "//connect.facebook.net/en_GB/all.js#xfbml=1&appId=306364829393363";
  fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>

<script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="https://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script>

    <section id="wrappermain">
        <div class="wrapper">


            <div class="gray-top">&nbsp;</div>
            <div class="content">


            <?php
                $query = "select * from workshop where id = '$id'";
                $result = mysql_query($query) or die (mysql_error() . ' ' .$query);
                while($row = mysql_fetch_assoc($result)) { ?>
            <div class="content-left">
                <h2><?php echo $row['headline']; ?></h2>
                    <artical>
                        <?php echo $row['details']; ?>
                    </artical>

                    <!--<div class="sharess"> 

                    <div class="fb-like" data-href="http://mysite.com/viewworkshop.php?id=<?php echo $id; ?>" data-send="true" data-width="200" data-show-faces="false"></div> 

                    <a href="https://twitter.com/share" class="twitter-share-button" data-url="http://mysite.com/viewworkshop.php?id=<?php echo $id; ?>" data-via="Atul_33" data-lang="en">Tweet</a>
                    </div>-->

            <!-- AddThis Button BEGIN -->
            <div style="width: 400px;">
            <a class="addthis_button" href="http://www.addthis.com/bookmark.php?v=300&amp;pubid=ra-50f6428f0c05d757"><img src="http://s7.addthis.com/static/btn/v2/lg-share-en.gif" width="160" height="20" alt="Bookmark and Share" style="border:0"/></a>
            <script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-50f6428f0c05d757"></script>
            <div class="addthis_toolbox addthis_default_style">
             <a class="addthis_button_facebook_send"></a> 
            </div>
            </div> 

            <!-- AddThis Button END -->

            </div>
            <div class="content-right">
                <div class="module_white">
                    <h2>Dates</h2>
                    <p><?php echo $row['start_date']; ?> and <?php echo $row['end_date']; ?></p>
                </div>
                <div class="module_white">
                    <h2>Location </h2>
                    <p><?php echo $row['address']; ?></p>
                </div>
                <div class="module_white">
                    <h2>Timings</h2>
                    <p><?php echo $row['start_time']; ?> to <?php echo $row['end_time']; ?>.</p>
                </div>
                <div class="module_white">
                    <h2>Maximum Seats</h2>
                    <p><?php echo $row['seats']; ?></p>
                </div>

                <div class="module_white">
                    <h2>Prerequisites</h2>
                    <p><?php echo $row['prerequisites']; ?></p>

                </div>
                <div class="module_white">
                    <h2>Join The Workshop</h2>
                    <p><?php echo $row['registration']; ?></p>
                </div>
                <div class="module_white">
                    <h2>Participation Fee</h2>
                    <p><?php echo $row['cost']; ?></p>
                </div>

            </div>
<?php } ?>

                    </div>





             <div class="gray-bot">&nbsp;</div>

        </div>

    </section>


 <?php 
    require('include/footer.php'); 
?>
3
  • The different behaviour between the two pages might be due to including config.php and header.php in a different order in each page. Oct 31, 2013 at 10:45
  • You also have HTML-injection (potential XSS) from echoing out row data without htmlspecialchars().
    – bobince
    Oct 31, 2013 at 11:20
  • The whole idea of using $_REQUEST is somehow wrong. Note that it contains the content of $_POST, $_GET and $_COOKIE. Just specify which method you want to use/receive.
    – HamZa
    Nov 8, 2013 at 18:34

2 Answers 2

8

Strictly speaking, yes you are correct, using intval should prevent sql injection. But note that using mysql_query is not considered a safe way to perform queries within PHP.

This example is still relatively simple, but more complex queries containing strings might not be that easy to sanitize yourself. You should be using either MySQLi, PDO or an ORM.

$stmt = $db->prep_stmt("SELECT * FROM newsevent where id = $id");

/* Binding 2 parameters. */
$stmt->bind_param("i", $id);

$userid = $_REQUEST['id'];


/* Executing the statement */
$stmt->execute( ) or die ("Could not execute statement");
2
  • The mysql_ functions are deprecated, but I disagree that that they are inherently unsafe - the client side binding in PDO uses mysql[i]_real_sescape_string. Prepare statements, particularly with PDO are not a miracle solution and have some nasties waiting to catch the unwary
    – symcbean
    Oct 31, 2013 at 9:23
  • The functions aren't unsafe, the problem is people do not sanitize their variables enough. I advice against using mysql_ functions because there are frameworks which are designed to cover as much of the gotchas as possible. But that's just my opinion. Oct 31, 2013 at 9:30
1

The error that you get is by putting two ' around the id which is the number take them off.

It should be this:

SELECT * FROM newsevent where id = $id

You cant inject sql injection. It will return 0 if it fails (if it is not a number).

With numbers going in, no injection is possible

3
  • already edit to SELECT * FROM newsevent where id = $id. Still return error when i insert the ' symbol in the url.
    – cupin06
    Oct 31, 2013 at 6:13
  • Try this. put first: OR 1=1-- . see if no error is returned. If there is no error..your code is vulnerable to SQL injection
    – Kratos
    Oct 31, 2013 at 8:16
  • Setting id to something like (SELECT id FROM user WHERE user.name LIKE '%admin%' ORDER BY id ASC LIMIT 1) will lead to SELECT * FROM newsevent where id = (SELECT id FROM user WHERE user.name LIKE '%admin%' ORDER BY id ASC LIMIT 1) ORDER BY id DESC which is sqlinj. This is a mostly useless example, but you get the point. Oct 31, 2013 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .