1
mysql_select_db($db.'_'.$table);    
include("/home/site/includes/".$type."/functions.php"); 

Would this be a bad idea if $table and $type are values passed via ajax from a JS script?

And this..

$function($args);

If the value for $function is passed via ajax?

1

Very risky.

The first could be used to perform operations on the wrong database, possibly bypassing access restrictions (I don't think it could access the MySQL internal database because of the underscore, but I could be wrong). The second could be manipulated to access any "functions.php" file in the filesystem, and if you also permit file uploads, this could allow unrestricted code injection. I don't know enough about PHP to know the full range of code injection permitted by the third example, but it looks highly dangerous (eg. passing a function of "system").

Edit: The correct way to deal with user input is to develop a whitelist that describes "known safe" input. In the case of $function, that means a list of acceptable function names; for mysql_select_db, a list of values for $table that the user is permitted to access. If you see an invalid value for user input, reject the entire transaction with a suitably vague error message. Anything else is just inviting problems from attackers who are cleverer than you.

| improve this answer | |
  • how about if I included an underscore in the function names so they are made up from two variables separated by the underscore? – Guesser Oct 23 '14 at 22:39
  • for the database would having a lookup table in php stop any problems, so at least I am restricting the tables that may get selected? – Guesser Oct 23 '14 at 22:41
  • If you force an underscore into the function name, the attacker will just pass "shell" and "exec" as the variables. – Mark Oct 23 '14 at 22:43
  • good point, maybe another delimiter e.g do_func_this where do & this are user inputted? – Guesser Oct 27 '14 at 10:59
  • Are you willing to bet your security on the assumption that PHP does not and never will have a built-in or library function that follows that naming pattern? – Mark Oct 27 '14 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.