pozmu.net::blog

Blog porzeraczamuzguw

Sposób na sql injection

Kiedyś robiłem trochę w PHP. Wszystko było fajnie i w ogóle, do momentu, gdy usłyszałem o sql injection. Padł blady strach, przetestowałem jedną z moich witryn i okazało się, że jest na to podatna. Zacząłem szukać jakiegoś rozwiązania ale prawdę mówiąć kiepsko mi szło… w końcu skleciłem funkcję która, jak mi się wydawało, dawała pełne bezpieczeństwo. Okazuje się jednak, że to zabezpieczenie można było łatwo obejść… na szczęście w owych czasach chyba nikt na to jeszcze nie wpadł. Anyway, jeśli chcecie się dobrze zabezpieczyć to znalazłem takie coś:

Zastosowanie:
// Przyjmujemy, dla przykładu:
$_POST['uid'] = 1;
$_POST['name'] = 'Łukasz "anAKiN" Lach';
$_POST['username'] = 'anakin';
$_POST['password'] = 'an4kin';
$_POST['newsletter'] = 1;

$sql = SQL('INSERT INTO users (id, uid, name, username, password, newsletter) '.
'VALUES (NULL, %d, %s, %s, %s, %b)', $_POST['uid'], $_POST['name'],
$_POST['username'], md5($_POST['password']), $_POST['newsletter']);

Wynikowa wartość (zapytanie wynikowe):
INSERT INTO users (id, uid, name, username, password, newsletter)
VALUES (NULL, 1, "Łukasz \"anAKiN\" Lach", "anakin",
"97296eca657a093aa379778c237e292d", 1)

Autor: Łukasz Lach.
To co mi się podoba w tym rozwiązaniu to bardzo ładna konstrukcja funkcji, emulująca znaną programistom składnię i ograniczająca kłopotliwość definiowania typu przekazywanych do bazy danych do minimum. Jednocześnie, jako że wszystko dzieje się tuż przed wysłaniem do bazy łatwo sobie przyswoić nawyk stosowania tej funkcji zamiast „gołego” zapytania SQL.

783 komentarze

  1. pandora jewelry official site powiedział:

    I am also commenting to let you understand what a perfect experience our girl had visiting your webblog. She noticed numerous details, which included what it’s like to have a very effective helping spirit to let many others really easily completely grasp certain hard to do matters. You truly did more than people’s desires. I appreciate you for presenting these invaluable, dependable, informative and in addition unique guidance on your topic to Ethel.

  2. yeezy 500 powiedział:

    I and also my buddies came taking note of the good ideas from the website and so before long got an awful feeling I had not expressed respect to the site owner for those techniques. The people are actually so glad to study them and have in effect actually been having fun with them. Many thanks for simply being really kind and then for picking variety of exceptional subjects most people are really needing to be informed on. Our own honest regret for not expressing appreciation to you earlier.

  3. golden goose outlet powiedział:

    My wife and i ended up being now peaceful that Ervin could finish off his survey by way of the ideas he grabbed out of the blog. It’s not at all simplistic just to happen to be offering points that some others have been making money from. We consider we need the writer to give thanks to because of that. The type of explanations you’ve made, the easy website navigation, the friendships you will help engender – it’s got all exceptional, and it’s helping our son and us feel that this concept is satisfying, and that is highly serious. Thanks for everything!

  4. birkin bag powiedział:

    I want to show my respect for your generosity for those people who require guidance on that idea. Your real dedication to passing the solution around became especially insightful and have continually enabled men and women much like me to reach their targets. The important recommendations indicates so much to me and still more to my fellow workers. Best wishes; from all of us.

  5. jordan shoes powiedział:

    I simply wanted to appreciate you once again. I am not sure what I might have achieved in the absence of the type of aspects shown by you over such area of interest. It truly was an absolute difficult dilemma in my position, nevertheless observing a expert manner you processed that made me to leap for delight. I’m grateful for your assistance and expect you recognize what a powerful job you happen to be carrying out teaching others using a site. I’m certain you haven’t encountered any of us.

  6. supreme new york powiedział:

    I enjoy you because of all of your effort on this web page. Kate loves conducting investigation and it’s really simple to grasp why. My spouse and i hear all about the dynamic tactic you deliver good ideas on the web blog and as well inspire response from other ones on the article so my daughter is truly discovering so much. Take pleasure in the remaining portion of the new year. You have been carrying out a pretty cool job.

  7. adidas yeezy powiedział:

    I’m commenting to let you be aware of what a impressive encounter our daughter encountered reading the blog. She even learned too many issues, including what it is like to have an awesome teaching mood to get folks smoothly know selected multifaceted topics. You really did more than her expectations. Thanks for churning out these useful, trusted, informative as well as cool thoughts on this topic to Julie.

  8. golden goose outlet powiedział:

    Thank you so much for giving everyone such a memorable opportunity to discover important secrets from this site. It really is so enjoyable and stuffed with amusement for me personally and my office co-workers to visit your blog at a minimum three times in 7 days to learn the newest secrets you have. And definitely, I am usually fulfilled with the very good tricks you serve. Selected 3 areas in this article are in fact the simplest we have all had.

  9. yeezy powiedział:

    I actually wanted to jot down a brief remark to appreciate you for all of the fabulous advice you are giving at this site. My time intensive internet search has finally been rewarded with wonderful tips to go over with my two friends. I would express that many of us readers are undeniably lucky to exist in a really good place with so many perfect people with very beneficial basics. I feel really lucky to have seen your website and look forward to really more fun moments reading here. Thanks once again for a lot of things.

  10. yeezy 350 v2 powiedział:

    I would like to express my passion for your generosity supporting all those that must have help on this study. Your personal commitment to passing the message up and down had become particularly productive and has helped guys like me to attain their objectives. This helpful advice signifies a great deal to me and especially to my fellow workers. Thank you; from all of us.

  11. generic cialis for sale powiedział:

    Do I need a drug destined for tadalafil. Since buy cialis online is barely nearby on recipe, you’ll need to finished an online consultation with an self-sufficient physician first your form is shipped. If you’re a good possibility, you’ll suffer a valid direction instead of buy generic cialis online india.

  12. buy cialis for daily use powiedział:

    Does Medicare be enough tadalafil. cheap generic cialis is a moderately priced drug employed to discuss erection problems in men. … how to buy cialis online is not covered before most Medicare and cover plans, but manufacturer and rather coupons can relieve offset the cost.

  13. cialis for sale cheap powiedział:

    https://www.ycialisy.com/# cialis low cost

  14. kobe sneakers powiedział:

    Thank you for your entire work on this site. Gloria take interest in engaging in investigations and it’s really obvious why. A number of us learn all about the lively ways you convey very useful guidance through your website and as well as welcome contribution from other people about this subject while our girl has been discovering a whole lot. Take pleasure in the remaining portion of the year. You’re the one conducting a useful job.

  15. yeezy shoes powiedział:

    I wanted to construct a comment to be able to say thanks to you for all the precious tips you are sharing on this website. My prolonged internet research has now been compensated with brilliant content to talk about with my companions. I would point out that many of us visitors are very much blessed to exist in a magnificent network with so many marvellous people with insightful principles. I feel somewhat happy to have seen your web page and look forward to plenty of more fun minutes reading here. Thanks once again for a lot of things.

  16. lebron 18 powiedział:

    I have to show my love for your generosity for those people who really want assistance with that situation. Your special commitment to passing the message up and down came to be extremely helpful and have usually encouraged individuals just like me to arrive at their objectives. Your entire helpful help can mean a great deal a person like me and substantially more to my colleagues. Thank you; from all of us.

  17. longchamp handbags powiedział:

    I simply desired to thank you very much once more. I’m not certain the things that I might have worked on in the absence of these opinions documented by you relating to such concern. It absolutely was an absolute challenging problem in my position, but being able to view a new professional technique you managed it took me to leap for gladness. I’m just grateful for your advice and in addition trust you find out what a great job that you’re doing educating many others by way of your website. I am sure you haven’t come across all of us.

  18. yeezy shoes powiedział:

    I must express my appreciation to the writer just for bailing me out of such a condition. Just after checking throughout the the web and finding techniques that were not pleasant, I was thinking my entire life was done. Existing minus the solutions to the problems you’ve solved as a result of this posting is a crucial case, as well as those which might have in a wrong way damaged my entire career if I had not come across your site. Your actual know-how and kindness in controlling every part was vital. I am not sure what I would’ve done if I hadn’t encountered such a thing like this. I can at this moment look forward to my future. Thanks a lot very much for this reliable and result oriented guide. I will not hesitate to suggest your web blog to anybody who would need guidance about this issue.

  19. giannis antetokounmpo shoes powiedział:

    Needed to put you the bit of remark in order to give many thanks again relating to the stunning techniques you’ve shared in this case. It’s quite tremendously open-handed of people like you to present publicly what exactly most of us would have made available as an e-book to help with making some dough for their own end, even more so since you could have tried it in the event you considered necessary. These techniques also served to become a easy way to comprehend other individuals have the identical desire the same as my personal own to know a little more with regards to this condition. I’m certain there are many more enjoyable situations up front for folks who examine your blog.

  20. hermes belts powiedział:

    Thank you for all your hard work on this site. Kate really likes working on investigations and it’s really easy to see why. All of us learn all concerning the dynamic tactic you present great suggestions by means of your web site and therefore invigorate contribution from the others on this area then our own daughter is in fact becoming educated so much. Take advantage of the remaining portion of the year. You are carrying out a terrific job.

  21. canadian pharmacy powiedział:

    https://www.canadianvolk.com/# silkroad online pharmacy

  22. curry 7 sour patch powiedział:

    A lot of thanks for each of your work on this website. My aunt loves getting into investigations and it’s really easy to understand why. Most people hear all of the dynamic ways you provide efficient secrets via the website and even encourage contribution from some other people on this idea plus our favorite simple princess is now learning so much. Take pleasure in the rest of the year. You’re carrying out a fantastic job.

  23. hermes birkin powiedział:

    I wanted to send a small remark to appreciate you for those lovely tips you are posting on this website. My particularly long internet search has finally been compensated with beneficial facts and strategies to talk about with my classmates and friends. I would assert that we site visitors are very much fortunate to exist in a useful community with many marvellous people with valuable techniques. I feel very much grateful to have used the website page and look forward to really more excellent minutes reading here. Thanks a lot once again for all the details.

  24. canada goose jacket powiedział:

    I am only writing to let you know what a perfect discovery my wife’s princess obtained using the blog. She learned a lot of things, most notably what it’s like to possess an ideal helping spirit to get the mediocre ones clearly know just exactly specific complicated subject matter. You actually did more than my expected results. Thanks for presenting these insightful, trusted, edifying not to mention cool thoughts on your topic to Kate.

  25. golden goose sneakers powiedział:

    I must express appreciation to you just for rescuing me from this problem. Because of researching through the internet and seeing views which were not productive, I was thinking my life was over. Living minus the approaches to the problems you’ve fixed through your entire blog post is a critical case, as well as the kind that would have badly affected my career if I hadn’t noticed your site. Your good natural talent and kindness in dealing with almost everything was very helpful. I am not sure what I would’ve done if I hadn’t discovered such a solution like this. I can also now look ahead to my future. Thanks a lot so much for your impressive and results-oriented guide. I will not be reluctant to propose your web page to anyone who should receive tips about this subject matter.

  26. kd 12 powiedział:

    My spouse and i got excited when Peter could complete his studies via the ideas he acquired from your web pages. It’s not at all simplistic just to be handing out steps that most people might have been selling. So we discover we have the writer to give thanks to because of that. Those explanations you’ve made, the straightforward site menu, the relationships you will help to instill – it’s got all unbelievable, and it’s facilitating our son and the family recognize that the theme is amusing, which is really pressing. Thanks for the whole lot!

  27. best online pharmacy levitra powiedział:

    vardenafil – https://levitraoffer.com/ which is better cialis or levitra

  28. adidas yeezy powiedział:

    I must show my admiration for your kind-heartedness giving support to individuals that should have help on this one area. Your special commitment to getting the message all around appeared to be exceptionally advantageous and has continuously helped folks much like me to achieve their goals. This interesting suggestions indicates so much a person like me and even further to my fellow workers. Thank you; from all of us.

  29. lebron 18 powiedział:

    I am also commenting to make you be aware of what a fantastic encounter my wife’s daughter obtained going through your web page. She figured out lots of details, which include what it is like to possess a very effective giving character to make folks completely understand specified very confusing issues. You really did more than people’s expectations. Thank you for presenting the great, dependable, edifying and also cool tips about that topic to Tanya.

  30. yeezy 700 powiedział:

    I truly wanted to construct a message so as to thank you for some of the nice recommendations you are writing on this website. My long internet search has at the end of the day been rewarded with wonderful facts and techniques to write about with my pals. I ‚d claim that most of us site visitors are extremely fortunate to exist in a superb site with very many special people with valuable hints. I feel pretty privileged to have encountered the web pages and look forward to some more enjoyable moments reading here. Thanks once more for a lot of things.

  31. kyrie 5 shoes powiedział:

    I am glad for writing to make you understand of the perfect discovery our child enjoyed reading the blog. She mastered some pieces, which included what it’s like to possess an incredible teaching nature to get certain people quite simply fully grasp specified complex subject areas. You undoubtedly surpassed visitors’ desires. Thanks for distributing these invaluable, trusted, educational as well as fun tips on your topic to Ethel.

  32. jordans shoes powiedział:

    I and my friends came looking at the best things located on your website and then I got a terrible suspicion I never expressed respect to the web site owner for those tips. Most of the boys are already as a consequence happy to see them and have in effect in reality been taking advantage of them. Thank you for truly being very considerate as well as for going for varieties of superior tips millions of individuals are really wanting to know about. Our sincere regret for not saying thanks to sooner.

  33. chrome hearts powiedział:

    I must point out my gratitude for your kind-heartedness in support of persons that really want help on this important idea. Your very own commitment to passing the message all through was pretty beneficial and have continuously permitted some individuals just like me to realize their pursuits. This valuable report can mean a lot a person like me and somewhat more to my fellow workers. Best wishes; from all of us.

Dodaj komentarz

Proszę zauważ: Moderacja komentarzy jest włączona i może opóźnieć pojawienie się twojego komentarza na stronie. Nie ma potrzeby wysyłania twojego komentarza ponownie.