pozmu.net::blog

Blog porzeraczamuzguw

Sposób na sql injection

Kiedyś robiłem trochę w PHP. Wszystko było fajnie i w ogóle, do momentu, gdy usłyszałem o sql injection. Padł blady strach, przetestowałem jedną z moich witryn i okazało się, że jest na to podatna. Zacząłem szukać jakiegoś rozwiązania ale prawdę mówiąć kiepsko mi szło… w końcu skleciłem funkcję która, jak mi się wydawało, dawała pełne bezpieczeństwo. Okazuje się jednak, że to zabezpieczenie można było łatwo obejść… na szczęście w owych czasach chyba nikt na to jeszcze nie wpadł. Anyway, jeśli chcecie się dobrze zabezpieczyć to znalazłem takie coś:

Zastosowanie:
// Przyjmujemy, dla przykładu:
$_POST['uid'] = 1;
$_POST['name'] = 'Łukasz "anAKiN" Lach';
$_POST['username'] = 'anakin';
$_POST['password'] = 'an4kin';
$_POST['newsletter'] = 1;

$sql = SQL('INSERT INTO users (id, uid, name, username, password, newsletter) '.
'VALUES (NULL, %d, %s, %s, %s, %b)', $_POST['uid'], $_POST['name'],
$_POST['username'], md5($_POST['password']), $_POST['newsletter']);

Wynikowa wartość (zapytanie wynikowe):
INSERT INTO users (id, uid, name, username, password, newsletter)
VALUES (NULL, 1, "Łukasz \"anAKiN\" Lach", "anakin",
"97296eca657a093aa379778c237e292d", 1)

Autor: Łukasz Lach.
To co mi się podoba w tym rozwiązaniu to bardzo ładna konstrukcja funkcji, emulująca znaną programistom składnię i ograniczająca kłopotliwość definiowania typu przekazywanych do bazy danych do minimum. Jednocześnie, jako że wszystko dzieje się tuż przed wysłaniem do bazy łatwo sobie przyswoić nawyk stosowania tej funkcji zamiast „gołego” zapytania SQL.

1 200 komentarzy

  1. supreme new york powiedział:

    My husband and i felt very fortunate that Emmanuel could finish up his investigation through the precious recommendations he made in your web page. It is now and again perplexing just to continually be giving for free thoughts that many some other people have been making money from. And now we figure out we now have the blog owner to give thanks to for that. The main illustrations you have made, the straightforward blog navigation, the relationships you can make it possible to engender – it is mostly amazing, and it is letting our son in addition to us reckon that that article is fun, which is particularly indispensable. Thanks for the whole lot!

  2. a bathing ape powiedział:

    I happen to be writing to make you be aware of what a awesome experience my friend’s child obtained browsing the blog. She mastered a lot of issues, which include how it is like to possess an amazing coaching mood to have others smoothly comprehend several advanced matters. You actually exceeded my expectations. I appreciate you for coming up with these essential, healthy, educational and even fun thoughts on your topic to Emily.

  3. Michaellek powiedział:

    cialis 20 mg https://cialiswithdapoxetine.com/# – cialis 20 mg

  4. stromectolforte.com powiedział:

    buy ivermectin https://stromectolforte.com/# buy stromectol uk ivermectin

  5. warnings for cetirizine powiedział:

    zyrtec picture of pill – http://allergyd.com

  6. twitter beğeni hilesi powiedział:

    Instantly Uploaded I’m here now??

  7. forum.canerildes.com powiedział:

    thank you for this post, I am a big fan of this site would like
    to proceed updated.

    Take a look at my webpage; forum.canerildes.com

  8. golden goose outlet powiedział:

    I am writing to let you be aware of what a excellent discovery our daughter developed reading through your web site. She realized several things, including what it’s like to have an awesome helping heart to make other people without hassle fully grasp a variety of multifaceted issues. You truly did more than readers’ expectations. I appreciate you for rendering those powerful, safe, revealing and even cool guidance on your topic to Tanya.

  9. off-white powiedział:

    I as well as my pals have been reading through the best ideas found on your web site and then at once developed a horrible suspicion I had not thanked the web site owner for those techniques. Most of the ladies became totally warmed to study all of them and have now in truth been making the most of them. Many thanks for actually being so thoughtful and for picking variety of tremendous topics millions of individuals are really eager to be informed on. My personal sincere regret for not expressing gratitude to you earlier.

  10. ivermectin horse paste for humans powiedział:

    stromectol 3mg https://stromectolforte.com/# buy stromectol ivermectine stromectol 6 mg

  11. adidas yeezy powiedział:

    I am just commenting to make you understand of the cool encounter my wife’s princess developed using your webblog. She figured out a lot of issues, which include how it is like to have an awesome helping mindset to get certain people with ease understand a variety of impossible subject areas. You really exceeded my desires. I appreciate you for coming up with these effective, trustworthy, explanatory and easy tips on the topic to Julie.

  12. curry shoes powiedział:

    I together with my buddies were actually reading through the good guides from your site and all of the sudden developed a terrible suspicion I never expressed respect to the blog owner for those strategies. All of the people are actually for this reason very interested to read through them and have simply been taking advantage of these things. Appreciate your getting well considerate as well as for figuring out varieties of cool things millions of individuals are really eager to know about. My very own sincere apologies for not expressing gratitude to earlier.

  13. drurrex powiedział:

    stromectol 3mg ivermectin tablets ivermectin for humans over the counter is stromectol coronavirus

  14. effective skin care powiedział:

    This is really attention-grabbing, You are an excessively skilled blogger.
    I’ve joined your rss feed and stay up for in the hunt for extra of your
    fantastic post. Also, I have shared your site in my social networks

    Also visit my web blog – effective skin care

  15. prettypeople.club powiedział:

    fantastic issues altogether, you simply received a emblem new reader.
    What could you suggest about your post that you made some days ago?
    Any positive?

    My web site prettypeople.club

  16. instagram reels beğeni satın al powiedział:

    It turns out who is stalking who ??

  17. instagram otomatik beğeni satın al powiedział:

    Oha 1 saat geçtikten sonra 1000 Takipçi geldi ??

  18. youtube beğeni satın al powiedział:

    Admin kim bilmiyorum ama tebrikler

  19. youtube paylaşım satın al powiedział:

    Neegggggggggggggg

  20. youtube yorum satın al powiedział:

    suan çildiriyorum gördükçe ????

  21. reels izlenme satın al powiedział:

    how or how

  22. igtv izlenme satın al powiedział:

    I never thought I would see people who viewed my profile on twitter 🙂

  23. twitter trend topic satın al powiedział:

    I don’t understand why you stalk me

  24. instagram reels izlenme satın al powiedział:

    It’s really amazing what’s up 🙂

  25. instagram video izlenme satın al powiedział:

    gerçekten veriyor tesekkür ederim??

  26. eat potatoes lose weight powiedział:

    I love your writing style truly enjoying this web site.

    Take a look at my web-site eat potatoes lose weight

  27. yeezy powiedział:

    I am writing to let you be aware of of the wonderful discovery my friend’s girl gained checking yuor web blog. She learned several issues, which include what it’s like to possess an incredible giving character to have other people without hassle understand a variety of advanced matters. You undoubtedly did more than people’s desires. Many thanks for coming up with these warm and helpful, safe, explanatory and as well as easy thoughts on the topic to Gloria.

  28. jordan 6 powiedział:

    I needed to post you a very little note to be able to thank you very much the moment again for those striking concepts you have documented at this time. It was extremely generous of people like you to allow unhampered precisely what numerous people would have marketed for an electronic book to get some cash on their own, certainly now that you might well have tried it in case you wanted. The secrets also worked like the fantastic way to fully grasp other people have a similar dreams just like my very own to find out very much more on the topic of this matter. I am sure there are numerous more pleasurable instances ahead for individuals who read through your blog post.

  29. kyrie 6 powiedział:

    I wanted to write you a very little word in order to say thank you yet again on the striking guidelines you’ve shared on this website. It was quite tremendously generous of you to present freely what most people could possibly have sold as an e-book to make some bucks for themselves, most notably seeing that you could have tried it in case you wanted. These techniques as well served to be a good way to know that many people have the same desire much like mine to grasp a whole lot more with regard to this matter. I’m sure there are millions of more pleasant instances in the future for folks who look over your blog.

  30. ketogenic diets powiedział:

    When some one searches for his required thing,
    so he/she wants to be available that in detail,
    therefore that thing is maintained over here.

    Have a look at my web-site … ketogenic diets

  31. http://23.95.102.216/viewtopic.php?id=357455 powiedział:

    Awesome article.

    Also visit my blog :: http://23.95.102.216/viewtopic.php?id=357455

  32. healthy eating pyramid powiedział:

    Wow! Thank you! I constantly wanted to write on my site something like that.
    Can I include a fragment of your post to my website?

    Also visit my web site :: healthy eating pyramid

  33. natural skin care tips powiedział:

    Outstanding quest there. What occurred after? Good luck!

    Feel free to surf to my web site; natural skin care tips

  34. 23.95.102.216 powiedział:

    I truly enjoy reading on this internet site, it holds fantastic articles.

    Here is my blog 23.95.102.216

  35. south beach diet powiedział:

    I gotta favorite this web site it seems very beneficial handy.

    Visit my site; south beach diet

  36. golden goose powiedział:

    I and also my guys were found to be going through the best tips and tricks on your web blog then quickly I got a horrible feeling I had not thanked the website owner for them. All of the men appeared to be for this reason excited to read through them and already have in actuality been using those things. Many thanks for actually being very helpful as well as for picking out some fantastic useful guides most people are really needing to understand about. Our own sincere apologies for not expressing gratitude to you sooner.

  37. golden goose outlet powiedział:

    I simply wanted to make a word to thank you for those pleasant tips you are posting on this website. My considerable internet lookup has at the end of the day been paid with pleasant facts to exchange with my family and friends. I would point out that we visitors actually are very much blessed to live in a magnificent network with many awesome professionals with very beneficial techniques. I feel rather lucky to have used your entire website and look forward to so many more enjoyable moments reading here. Thanks again for all the details.

  38. kd 10 powiedział:

    I wanted to compose a quick message so as to express gratitude to you for those nice tricks you are showing at this website. My particularly long internet look up has now been compensated with reputable facts and strategies to go over with my close friends. I ‚d tell you that many of us visitors are unequivocally blessed to be in a remarkable network with many awesome people with very beneficial tips. I feel rather privileged to have seen your entire website and look forward to tons of more enjoyable times reading here. Thank you once again for a lot of things.

  39. chrome hearts online store powiedział:

    I have to express thanks to the writer just for rescuing me from such a instance. After browsing throughout the search engines and obtaining things which are not beneficial, I figured my entire life was gone. Being alive devoid of the strategies to the problems you have solved through your good report is a crucial case, and the kind which might have badly damaged my entire career if I hadn’t noticed your blog. Your actual expertise and kindness in playing with all the details was tremendous. I don’t know what I would’ve done if I had not come upon such a point like this. I’m able to at this time look ahead to my future. Thank you so much for this high quality and results-oriented help. I won’t think twice to recommend your blog post to anybody who should have tips on this topic.

  40. stromectoloff.com powiedział:

    generisk stromectol https://www.ivermecton.com/ ivermectin for humans for sale

  41. gabapentin 100mg price powiedział:

    what is normal blood pressure? http://gabenhim.com – gabapentin shingles

  42. http://novogorskpark.ru/ powiedział:

    I want to show appreciation to the writer just for bailing me out of such a issue.

    Just after looking throughout the world wide web and getting suggestions which are not pleasant, I assumed my life was done.
    Existing without the presence of solutions to the issues you have
    solved all through your main guideline is a serious case,
    and the ones which could have in a negative way damaged my entire career if I had not discovered your website.
    Your actual knowledge and kindness in controlling everything
    was very helpful. I’m not sure what I would’ve done if I hadn’t discovered such a
    step like this. I’m able to at this moment look
    forward to my future. Thanks a lot so much for
    your professional and sensible guide. I will not think twice to propose your site to any person who needs
    recommendations about this topic.

    Look at my web-site http://novogorskpark.ru/

  43. personal cannabis seeds powiedział:

    Whats up very cool blog!! Guy .. Excellent .. Superb .. I’ll bookmark your site and take the feeds also?I am satisfied to seek out numerous helpful info here within the
    put up, we want develop more strategies on this regard, thanks for sharing.

    Feel free to visit my page – personal cannabis seeds

  44. care products powiedział:

    This info is worth everyone’s attention. When can I find out more?

    My site :: care products

  45. https://www.medflyfish.com powiedział:

    It’s appropriate time to make some plans for the longer term and it is time to be happy.
    I have read this put up and if I may I want to counsel
    you some attention-grabbing issues or advice.
    Maybe you can write next articles referring to this article.
    I want to learn even more things about it!

    Also visit my web site: https://www.medflyfish.com

  46. biblioray.pusku.com powiedział:

    Right now it appears like Movable Type is the top blogging platform out there right now.
    (from what I’ve read) Is that what you are using on your blog?

    Check out my web site … biblioray.pusku.com

  47. eczema heals powiedział:

    Terrific work! That is the kind of info that should be shared
    across the internet. Shame on the search engines for not positioning this post higher!

    Come on over and talk over with my web site . Thanks =)

    my web site … eczema heals

  48. yeezy powiedział:

    I precisely needed to appreciate you yet again. I do not know the things I would have implemented without the strategies discussed by you relating to that industry. Previously it was a very distressing circumstance for me personally, nevertheless taking a look at a skilled style you resolved it made me to cry with delight. Now i’m happy for your information and in addition believe you know what a great job that you are doing training other individuals via a blog. I am certain you haven’t come across all of us.

  49. stromectolforte.com powiedział:

    mua ivermectin nz https://stromectolforte.com/ ivermectin for humans for sale 3mg ivermactin

  50. etherve powiedział:

    where to buy ivermectin buy stromectol online uk stromectol ШЁШ±Ш·Ш§Щ†ЫЊЫЃ stromectol liquid

Dodaj komentarz

Proszę zauważ: Moderacja komentarzy jest włączona i może opóźnieć pojawienie się twojego komentarza na stronie. Nie ma potrzeby wysyłania twojego komentarza ponownie.