pozmu.net::blog

Blog porzeraczamuzguw

Sposób na sql injection

Kiedyś robiłem trochę w PHP. Wszystko było fajnie i w ogóle, do momentu, gdy usłyszałem o sql injection. Padł blady strach, przetestowałem jedną z moich witryn i okazało się, że jest na to podatna. Zacząłem szukać jakiegoś rozwiązania ale prawdę mówiąć kiepsko mi szło… w końcu skleciłem funkcję która, jak mi się wydawało, dawała pełne bezpieczeństwo. Okazuje się jednak, że to zabezpieczenie można było łatwo obejść… na szczęście w owych czasach chyba nikt na to jeszcze nie wpadł. Anyway, jeśli chcecie się dobrze zabezpieczyć to znalazłem takie coś:

Zastosowanie:
// Przyjmujemy, dla przykładu:
$_POST['uid'] = 1;
$_POST['name'] = 'Łukasz "anAKiN" Lach';
$_POST['username'] = 'anakin';
$_POST['password'] = 'an4kin';
$_POST['newsletter'] = 1;

$sql = SQL('INSERT INTO users (id, uid, name, username, password, newsletter) '.
'VALUES (NULL, %d, %s, %s, %s, %b)', $_POST['uid'], $_POST['name'],
$_POST['username'], md5($_POST['password']), $_POST['newsletter']);

Wynikowa wartość (zapytanie wynikowe):
INSERT INTO users (id, uid, name, username, password, newsletter)
VALUES (NULL, 1, "Łukasz \"anAKiN\" Lach", "anakin",
"97296eca657a093aa379778c237e292d", 1)

Autor: Łukasz Lach.
To co mi się podoba w tym rozwiązaniu to bardzo ładna konstrukcja funkcji, emulująca znaną programistom składnię i ograniczająca kłopotliwość definiowania typu przekazywanych do bazy danych do minimum. Jednocześnie, jako że wszystko dzieje się tuż przed wysłaniem do bazy łatwo sobie przyswoić nawyk stosowania tej funkcji zamiast „gołego” zapytania SQL.

108 komentarzy

  1. reebok outlet powiedział:

    I would like to express some appreciation to the writer for bailing me out of such a setting. Right after checking throughout the the web and coming across tips which are not beneficial, I thought my entire life was done. Existing without the presence of approaches to the problems you’ve sorted out by means of your entire short article is a serious case, as well as the ones that could have negatively affected my career if I had not noticed your website. That know-how and kindness in taking care of every aspect was invaluable. I don’t know what I would have done if I had not discovered such a step like this. I can also at this time relish my future. Thanks so much for this specialized and amazing guide. I will not think twice to refer the website to any person who should receive assistance on this situation.

  2. GulyaevKriskentii1988nof powiedział:

    is perth australia

    9e6b 5 mg is and avodart

  3. ysl handbags powiedział:

    I am just commenting to make you be aware of of the helpful experience my child gained visiting your webblog. She even learned such a lot of pieces, most notably how it is like to possess a very effective coaching nature to make the mediocre ones completely grasp a variety of hard to do things. You really exceeded her desires. I appreciate you for distributing those warm and friendly, safe, explanatory and as well as fun tips on your topic to Julie.

  4. GulyaevKriskentii1988nof powiedział:

    costo del is ato

    9e6b is son generique

  5. GulyaevKriskentii1988nof powiedział:

    experience with is

    9e6b is medikamente

  6. GulyaevKriskentii1988nof powiedział:

    is generika online kaufen

    9e6b be now is canadian cost

  7. yeezy boost 350 v2 powiedział:

    Thanks a lot for providing individuals with remarkably spectacular opportunity to read critical reviews from here. It is usually very nice and full of a lot of fun for me and my office peers to visit the blog really 3 times in 7 days to find out the latest stuff you have. Of course, I’m also certainly astounded for the impressive knowledge you give. Selected 4 areas in this post are clearly the finest we’ve had.

  8. GulyaevKriskentii1988nof powiedział:

    india is barata genrica

    9e6b is wholesale online usa

  9. GulyaevKriskentii1988nof powiedział:

    is wirkung risiken

    9e6b is 25 mg cost

  10. GulyaevKriskentii1988nof powiedział:

    is women effects

    9e6b only now usa at is

  11. james harden shoes powiedział:

    I simply desired to thank you so much again. I do not know the things that I might have carried out without the type of tips and hints discussed by you concerning such question. Completely was the hard scenario for me, but discovering the professional avenue you dealt with the issue took me to weep for gladness. I’m just happier for this work and thus hope you recognize what a powerful job you are always accomplishing instructing others using your website. I am certain you haven’t come across all of us.

  12. kyrie 4 powiedział:

    Thanks so much for giving everyone an extremely spectacular chance to read articles and blog posts from this website. It’s usually very sweet and also full of a good time for me personally and my office fellow workers to search the blog nearly 3 times in one week to read through the latest items you will have. Of course, I am also always astounded considering the splendid tricks you serve. Certain two tips in this post are honestly the very best I have had.

  13. golden goose outlet powiedział:

    Needed to draft you one tiny observation to be able to give thanks again for all the beautiful strategies you have discussed at this time. It has been seriously open-handed of you to present freely all that some people could possibly have made available as an ebook to generate some cash on their own, even more so given that you could have done it in the event you desired. Those principles also served to become a great way to know that some people have the identical fervor just as my very own to know much more in regard to this problem. I am sure there are thousands of more fun occasions up front for those who scan your site.

  14. lebron james shoes powiedział:

    I would like to show some thanks to you for rescuing me from this predicament. Because of checking throughout the internet and meeting views which were not pleasant, I believed my life was well over. Being alive without the approaches to the problems you’ve solved as a result of the site is a critical case, as well as ones which might have in a wrong way affected my career if I had not come across your site. The know-how and kindness in maneuvering almost everything was tremendous. I am not sure what I would’ve done if I hadn’t come across such a thing like this. It’s possible to at this point relish my future. Thanks very much for the reliable and sensible help. I won’t be reluctant to refer the sites to any person who needs guidance about this situation.

  15. michael kors outlet powiedział:

    I wish to show some thanks to the writer just for rescuing me from this particular setting. Right after surfing around throughout the internet and seeing notions which are not pleasant, I thought my entire life was done. Being alive without the presence of solutions to the issues you’ve sorted out by way of your entire report is a crucial case, as well as ones that might have negatively affected my entire career if I hadn’t encountered your web blog. Your good talents and kindness in controlling a lot of stuff was priceless. I’m not sure what I would have done if I had not discovered such a thing like this. I am able to at this time relish my future. Thanks a lot very much for this expert and effective guide. I won’t hesitate to propose your blog to anyone who needs and wants guidelines on this issue.

  16. yeezy sneakers powiedział:

    I am only writing to let you understand of the exceptional experience our princess gained reading through your web site. She picked up a lot of things, with the inclusion of what it is like to possess an incredible giving heart to have many people without problems know a variety of tortuous issues. You really surpassed my desires. Thanks for coming up with these important, dependable, educational not to mention cool guidance on the topic to Julie.

  17. NelidaPestova92nof powiedział:

    comprare is 5mg

    eb98 female is perth australia

  18. NelidaPestova92nof powiedział:

    overnight is brand online

    eb98 is ato tampic

  19. NelidaPestova92nof powiedział:

    be real is australia

    eb98 order at is c o d

  20. NelidaPestova92nof powiedział:

    is professional tadalafi

    eb98 be is visa discover

  21. NelidaPestova92nof powiedział:

    escompte en ligne is

    eb98 is par internet

  22. NelidaPestova92nof powiedział:

    is order australia

    eb98 cheapest is usa

  23. NelidaPestova92nof powiedział:

    is de la india

    eb98 fast order is

  24. NelidaPestova92nof powiedział:

    cost of is 20 mg cvs

    eb98 look there is malaysia

  25. AnvarKirillov94nof powiedział:

    998a women is dosage

    http://ph-c8cbd-3-1.com/

    comprar iss india

  26. AnvarKirillov94nof powiedział:

    998a there different types is

    be is pills canada

  27. GenriettaOvchinnikova1993nof powiedział:

    is at western union

    cab8 is ventas genricas

  28. GenriettaOvchinnikova1993nof powiedział:

    is 20mg medpex

    cab8 is online 25mg

  29. GenriettaOvchinnikova1993nof powiedział:

    good choice inexpensive is

    cab8 be is ghana

  30. GenriettaOvchinnikova1993nof powiedział:

    isjelly online

    cab8 isjelly online

  31. GenriettaOvchinnikova1993nof powiedział:

    just try usa at is

    cab8 is online 25mg

  32. GenriettaOvchinnikova1993nof powiedział:

    prix is lilly

    cab8 long term side effects is

  33. GenriettaOvchinnikova1993nof powiedział:

    prix is lilly

    cab8 is dosage 10 m

  34. GenriettaOvchinnikova1993nof powiedział:

    recommended site is rx

    cab8 is en las mujere

  35. GenriettaOvchinnikova1993nof powiedział:

    vente is pharmacie

    cab8 il is fa male al cuore

  36. GenriettaOvchinnikova1993nof powiedział:

    online at at is

    cab8 just try best online is

  37. GenriettaOvchinnikova1993nof powiedział:

    is ato

    cab8 prix is lilly

  38. ArtemevaYaromira89nof powiedział:

    acheter is occasion

    c471 que es is o levitr

  39. ArtemevaYaromira89nof powiedział:

    achat is gnrique

    c471 is20 mg

  40. ArtemevaYaromira89nof powiedział:

    can i use is without ed

    c471 is jelly tablets us online

  41. ArtemevaYaromira89nof powiedział:

    i recommend gerenic is

    c471 cheap is online from india

  42. ArtemevaYaromira89nof powiedział:

    60 mg is reviews

    c471 is acquisto online

  43. ArtemevaYaromira89nof powiedział:

    safe be is online

    c471 how to take is soft

  44. ArtemevaYaromira89nof powiedział:

    is professional online usa

    c471 achat is sur le ne

  45. ArtemevaYaromira89nof powiedział:

    discount is 40 mg

    c471 brand is order online

  46. ArtemevaYaromira89nof powiedział:

    is at online cheap

    c471 is pills ingreediants

  47. ArtemevaYaromira89nof powiedział:

    taking low dose is

    c471 canada free sample is 5 mg

  48. ArtemevaYaromira89nof powiedział:

    we use it is discounted

    c471 click here is 20 mg

  49. ArtemevaYaromira89nof powiedział:

    i recommend is online be

    c471 precios is genrico

  50. jordan 4 powiedział:

    I just wanted to type a quick note to express gratitude to you for all of the wonderful guides you are giving on this site. My considerable internet investigation has finally been honored with beneficial tips to share with my friends and family. I would say that many of us site visitors actually are quite endowed to be in a useful website with very many outstanding individuals with very beneficial principles. I feel pretty happy to have discovered your entire webpage and look forward to tons of more entertaining minutes reading here. Thank you once more for all the details.

Dodaj komentarz

Proszę zauważ: Moderacja komentarzy jest włączona i może opóźnieć pojawienie się twojego komentarza na stronie. Nie ma potrzeby wysyłania twojego komentarza ponownie.