0

I have made a PHP forum. I used PDO, as well as SQLi. When I did a security scan of my website, it found errors, and after a long time of trying different stuff, I can't fix them.

Points to whomever help me fix them.

I got the following errors:

sql injection
Classification Input: Validation Error
Resource: view_topic.php
Parameter: id
Method: GET

sql injection
Classification Input: Validation Error
Resource: add_answer.php
Parameter: a_email
Parameter: a_answer
Parameter: a_name
Parameter: id
Method: GET

Integer overflow
Classification: Boundary Condition Error
Resource: view_topic.php?id=2147483647
Parameter: id
Method: GET

Integer overflow
Classification: Boundary Condition Error
Resource: view_topic.php?id=2147483647
Parameter: id
Method: GET

Cross site scripting
Classification: Input Validation Error
Resource: view_topic
Resource: /add_answer.php
Parameter: id
Method: GET

PHP FILES
add_answer.php

<?php

$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password="linux"; // Mysql password 
$db_name="simpleFourm"; // Database name 
$tbl_name="fanswer"; // Table name 

// Create connection
$conn = new mysqli($host, $username, $password, $db_name);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}


// Get value of id that sent from hidden field 
$id=$_POST['id'];

// Find highest answer number. 
$sql="SELECT MAX(a_id) AS Maxa_id FROM $tbl_name WHERE question_id='$id'";
$result = $conn->query($sql); 

$rows=mysqli_fetch_array($result);

// add + 1 to highest answer number and keep it in variable name "$Max_id". if there no answer yet set it = 1 
if ($rows) {
$Max_id = $rows['Maxa_id']+1;
}
else {
$Max_id = 1;
}

// get values that sent from form 
$a_name=$_POST['a_name'];
$a_email=$_POST['a_email'];
$a_answer=$_POST['a_answer']; 

$datetime=date("d/m/y H:i:s"); // create date and time

// Insert answer 
$sql2="INSERT INTO $tbl_name(question_id, a_id, a_name, a_email, a_answer, a_datetime)VALUES('$id', '$Max_id', '$a_name', '$a_email', '$a_answer', '$datetime')";
$result2 = $conn->query($sql2); 

if($result2){
echo "Successful<BR>";
echo "<a href='view_topic.php?id=".$id."'>View your answer</a>";

// If added new answer, add value +1 in reply column 
$tbl_name2="fquestions";
$sql3="UPDATE $tbl_name2 SET reply='$Max_id' WHERE id='$id'";
$result3 = $conn->query($sql3); 

}
else {
echo "ERROR";
}

// Close connection
$conn->close();
?>

view_topic.php

<?php

$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password="linux"; // Mysql password 
$db_name="simpleFourm"; // Database name 
$tbl_name="fquestions"; // Table name 

// Create connection
$conn = new mysqli($host, $username, $password, $db_name);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// get value of id that sent from address bar 
$id=$_GET['id'];
$sql="SELECT * FROM $tbl_name WHERE id='$id'";
$result = $conn->query($sql); 

$rows=mysqli_fetch_array($result);
?>

<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td><table width="100%" border="0" cellpadding="3" cellspacing="1" bordercolor="1" bgcolor="#FFFFFF">
<tr>
<td bgcolor="#F8F7F1"><strong><?php echo $rows['topic']; ?></strong></td>
</tr>

<tr>
<td bgcolor="#F8F7F1"><?php echo $rows['detail']; ?></td>
</tr>

<tr>
<td bgcolor="#F8F7F1"><strong>By :</strong> <?php echo $rows['name']; ?> <strong>Email : </strong><?php echo $rows['email'];?></td>
</tr>

<tr>
<td bgcolor="#F8F7F1"><strong>Date/time : </strong><?php echo $rows['datetime']; ?></td>
</tr>
</table></td>
</tr>
</table>
<BR>

<?php

$tbl_name2="fanswer"; // Switch to table "forum_answer"
$sql2="SELECT * FROM $tbl_name2 WHERE question_id='$id'";
$result2  = $conn->query($sql2);

if ($result2->num_rows > 0) {
    // output data of each row
    while($rows = $result2->fetch_assoc()) {
?>

<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td><table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td bgcolor="#F8F7F1"><strong>ID</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><?php echo $rows['a_id']; ?></td>
</tr>
<tr>
<td width="18%" bgcolor="#F8F7F1"><strong>Name</strong></td>
<td width="5%" bgcolor="#F8F7F1">:</td>
<td width="77%" bgcolor="#F8F7F1"><?php echo $rows['a_name']; ?></td>
</tr>
<tr>
<td bgcolor="#F8F7F1"><strong>Email</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><?php echo $rows['a_email']; ?></td>
</tr>
<tr>
<td bgcolor="#F8F7F1"><strong>Answer</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><?php echo $rows['a_answer']; ?></td>
</tr>
<tr>
<td bgcolor="#F8F7F1"><strong>Date/Time</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><?php echo $rows['a_datetime']; ?></td>
</tr>
</table></td>
</tr>
</table><br>

<?php
  }
} else {
    echo "<font color='red'>0 results</font>" ; 

}


$sql3="SELECT view FROM $tbl_name WHERE id='$id'";
$result3 = $conn->query($sql3);

$rows=mysqli_fetch_array($result3);


$view=$rows['view'];

// if have no counter value set counter = 1
if(empty($view)){
$view=1;

$sql4="INSERT INTO $tbl_name(view) VALUES('$view') WHERE id='$id'";
$result4 = $conn->query($sql4);

}

// count more value
$addview=$view+1;
$sql5="update $tbl_name set view='$addview' WHERE id='$id'";
$result5  = $conn->query($sql5);
$conn->close();
?>

<BR>
<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<form name="form1" method="post" action="add_answer.php">
<td>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td width="18%"><strong>Name</strong></td>
<td width="3%">:</td>
<td width="79%"><input name="a_name" type="text" id="a_name" size="45"></td>
</tr>
<tr>
<td><strong>Email</strong></td>
<td>:</td>
<td><input name="a_email" type="text" id="a_email" size="45"></td>
</tr>
<tr>
<td valign="top"><strong>Answer</strong></td>
<td valign="top">:</td>
<td><textarea name="a_answer" cols="45" rows="3" id="a_answer"></textarea></td>
</tr>
<tr>
<td>&nbsp;</td>
<td><input name="id" type="hidden" value="<?php echo $id; ?>"></td>
<td><input type="submit" name="Submit" value="Submit"> <input type="reset" name="Submit2" value="Reset"></td>
</tr>
</table>
</td>
</form>
</tr>
</table>

closed as too broad by schroeder, WhiteWinterWolf, TildalWave, Scott Pack, Mark Jul 25 '15 at 2:03

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

3

When talking about SQL injection, regardless of language, you should use parametrized queries. These construct a query plan ahead of time, rather than when the user provides input, so an attacker cannot easily modify how the query works.

PHP supports this, but you need to use the PDO library rather than the mysqli functions. http://php.net/pdo for more information. It does take more work than simple queries with mysqli, but you get SQLi protection by using parametrized queries, and it's a good practice to start doing.

Secondly, you should not use MySQL's root user to connect to your database. Defense in depth practices include running an application with as few permissions as you need. And I really hope that isn't your root password to your database.

  • Unfortunately, PHP’s database features are quite rudimentary/low level, just PHP wrappers for the DBMS API. There is no convenient way like $x->exec('SELECT * FROM x WHERE y=?', $_POST['z']);. Instead you have to do everything (preparing, parameter binding/assignment, execution) on your own. – Gumbo Jul 24 '15 at 15:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.