Tuesday 27 September 2016

PHP MySQL $_GET Hack prevention











If I were to use the $_GET function to retrieve a variable from the URL how can I make it hack proof? Right now I just have addSlashes, what else should I add?



$variable1 = addslashes($_GET['variable1']);
//www.xxxxx.com/GetTest.php?variable1=xxxx

Answer



The first and foremost rule with ANY input, not just $_GET but even with $_POST, $_FILES and anything you read from disk or from a stream you should always VALIDATE.




Now to answer your question in more details, you have several HACKS that exist in this world. Let me show you some:



XSS injections



If you accept data from the URL such as from the $_GET and output this data without stripping out possible tags, you might render your site prone to XSS injection or code injection. For example:



http://myhoturl.com/?search=



This would output a hack to your site and people would be redirected to another page. This page could be a phishing attempt to steal credentials



SQL Injection



It is possible to inject SQL to your application. For example:



http://myhoturl.com/?search=%'; UPDATE users SET password=MD5('hello'); SELECT * FROM users WHERE username LIKE '%


Would make your SQL look like this:




SELECT * FROM articles WHERE title LIKE '%%'; UPDATE users SET password=MD5('hello'); SELECT * FROM users WHERE username LIKE '%%';


And thus you'd update all your user's password to Hello and then return something that doesn't match.



This is only a brief overview of what you can do with SQL injection. To protect yourself, use mysql_real_escape_string or PDO or any good DB abstraction layer.



Code injection




Lots of people like to include data from somewhere on the disk and allow uploads of files. For example:



//File igotuploaded.txt



And the url allows you to INCLUDE a file by name. ?show=myhotfile.txt



//In this file we include myhotfile.txt
include($_GET['show']);



The person changes that to ?show=../uploads/igotuploaded.txt and you will run echo 'Hello world';



That is dangerous.



rule of thumb... NEVER TRUST USER INPUT, always validate, prevent, validate, fix, validate and again correct...



Good luck


No comments:

Post a Comment

c++ - Does curly brackets matter for empty constructor?

Those brackets declare an empty, inline constructor. In that case, with them, the constructor does exist, it merely does nothing more than t...