PHP——自动SQL注入保护？

发布于 2024-08-30 20:42:23 字数 1360 浏览 8 评论 0原文

我最近接手了 PHP 应用程序的维护，我对 PHP 不太熟悉，但我在网站上看到的一些内容让我担心它可能容易受到 SQL 注入攻击。

例如，看看这段用于登录管理部分的代码是如何工作的：

    $password = md5(HASH_SALT . $_POST['loginPass']);
    $query = "SELECT * FROM `administrators` WHERE `active`='1' AND `email`='{$_POST['loginEmail']}' AND `password`='{$password}'";
    $userInfo = db_fetch_array(db_query($query));

    if($userInfo['id']) {
        $_SESSION['adminLoggedIn']  = true;
        // user is logged in, other junk happens here, not important

该网站的创建者制作了一个特殊的 db_query 方法和 db_fetch_array 方法，如下所示：

function db_query($qstring,$print=0)        { return @mysql(DB_NAME,$qstring); }
function db_fetch_array($qhandle)       { return @mysql_fetch_array($qhandle); }

现在，这让我认为我应该能够进行某种 SQL 注入攻击电子邮件地址如下：

' OR 'x'='x' LIMIT 1;

和一些随机密码。当我在命令行上使用它时，我得到了一个管理用户，但是当我在应用程序中尝试它时，我得到了一个无效的用户名/密码错误，就像我应该的那样。

他们是否启用了某种全局 PHP 配置来阻止这些攻击？那要在哪里配置呢？

这是 PHP --version 信息：

# php --version
PHP 5.2.12 (cli) (built: Feb 28 2010 15:59:21) 
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2009 Zend Technologies
    with the ionCube PHP Loader v3.3.14, Copyright (c) 2002-2010, by ionCube Ltd., and
    with Zend Optimizer v3.3.9, Copyright (c) 1998-2009, by Zend Technologies

原文

I took over maintenance of a PHP app recently and I'm not super familiar with PHP but some of the things I've been seeing on the site are making me nervous that it could be vulnerable to a SQL injection attack.

For example, see how this code for logging into the administrative section works:

    $password = md5(HASH_SALT . $_POST['loginPass']);
    $query = "SELECT * FROM `administrators` WHERE `active`='1' AND `email`='{$_POST['loginEmail']}' AND `password`='{$password}'";
    $userInfo = db_fetch_array(db_query($query));

    if($userInfo['id']) {
        $_SESSION['adminLoggedIn']  = true;
        // user is logged in, other junk happens here, not important

The creators of the site made a special db_query method and db_fetch_array method, shown here:

function db_query($qstring,$print=0)        { return @mysql(DB_NAME,$qstring); }
function db_fetch_array($qhandle)       { return @mysql_fetch_array($qhandle); }

Now, this makes me think I should be able to do some sort of SQL injection attack with an email address like:

' OR 'x'='x' LIMIT 1;

and some random password.
When I use that on the command line, I get an administrative user back, but when I try it in the application, I get an invalid username/password error, like I should.

Could there be some sort of global PHP configuration they have enabled to block these attacks? Where would that be configured?

Here is the PHP --version information:

# php --version
PHP 5.2.12 (cli) (built: Feb 28 2010 15:59:21) 
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2009 Zend Technologies
    with the ionCube PHP Loader v3.3.14, Copyright (c) 2002-2010, by ionCube Ltd., and
    with Zend Optimizer v3.3.9, Copyright (c) 1998-2009, by Zend Technologies

分享到QQ

分享到微博