MYSQL Injection !

Discussion in 'PHP' started by encom, Jun 29, 2009.

  1. #1
    I use this free webhost that has just canceled my account :mad:.
    They told me that the reason was because of a long mysql query :confused:
    I then checked my email and my host had sent me part of the query and here it is:

    
    select * from games where id = 1 and 1=0 =null union select 1 , unhex(hex(concat(0x5b6b65795d,schem
    
    Code (markup):
    And this is the query that I actually used on the page:
    
    select * from games where id = '$id'
    
    Code (markup):
    URL = view.php?id=1

    Could it be that they injected the code into my id in the url?
    How could I prevent this in future?

    Sorry if this dosnt make any sence :eek:

    Grant,
    PS: Host has agreed to re-activate my account (few)
     
    encom, Jun 29, 2009 IP
  2. shiatsu

    shiatsu Peon

    Messages:
    45
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    There are ways to tackle XSS injection. You need to learn best practices or to hire a developer to do the security part. That page should be /view/1 and the result should be protected against XSS. If you have a full custom made site, look at the codeigniter framework. It's a PHP framework that has XSS filtering inclueded.

    PEace
     
    shiatsu, Jun 29, 2009 IP
  3. encom

    encom Member

    Messages:
    58
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    41
    #3
    hmmm,

    would this work as a tempory fix while I research this?

    
    if(!is_numeric($id)){
    die('ERROR');
    }
    
    Code (markup):
     
    encom, Jun 29, 2009 IP
  4. daringtakers

    daringtakers Well-Known Member

    Messages:
    808
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    110
    #4
    daringtakers, Jun 30, 2009 IP
  5. harrisunderwork

    harrisunderwork Well-Known Member

    Messages:
    1,005
    Likes Received:
    21
    Best Answers:
    0
    Trophy Points:
    135
    #5
    Always check the values to be passed, like is it really 2 length or is it really numeric.

    Then only pass it to database queries.
     
    harrisunderwork, Jun 30, 2009 IP