yours is the first example that i have seen that brings clarity to this..
Thank you!
what i have been told is that my program protects against injection by making everything an int value... thats a brain full..
Well, if the field is an integer, and you take steps to ensure that all inputs are actually just integers, that should work too... The idea is that, given the field types and what operations are being done (INSERTs, SELECTs, UPDATEs, etc.) using these inputs, try to figure out all the bogus inputs that someone might give, to get around whatever security you might have. In my previous posting, I gave an example where a field was being compared against an input, but someone who knew (or could guess) what the SQL statement was could fashion their input so as to fool the SQL statement into doing something different than what you intended.
$sql .= "SET `hits` = `hits` + 1 WHERE `id` = '{$aId}'";
you have done something to absolutely verify that
$aId is an integer and nothing but an integer, that should be safe. The single quotes ' would not even be needed. However, if a user could sneak in
123' OR 1=1 OR id='456, they would get a "WHERE" clause that was always true (so
all records would have their "hits" incremented).
$sql .= " VALUES ('{$aId}', '{$aPid}', '{$aUid}', '{$aReferrer}', NOW(), NOW(), '{$_SERVER["REMOTE_ADDR"]}') ";
If you have verified that $aId, $aPid, $aUid (user inputs?) are integers, that should be OK. If there is a mismatch between the field type and what you're trying to store in the record, you'll probably get an SQL error. BTW, I see you using NOW() for both date and time fields. Be sure to check that it's doing the expected thing (is `date` actually a date field, and similar for `time`?). date and time are SQL reserved words, so it's not good to use them as field names (putting them in `backticks` should prevent an error).
if((INT)$aAff['id']<=0)
{
return;
}
If you've confirmed that casting $aAff['id'] to an
int will return a non-positive integer for any incorrect input, then it sounds like you're set. Just be sure to check cases such as
123' OR 1=1 OR id='456 that you don't pass inspection with a 123 value. What you might consider doing is assigning the cast value into a local integer variable, and using that in the query:
$local = (int)$aAff['id'];
if ($local <= 0) return;
$sql = "UPDATE `{$this->mPrefix}affiliates` SET ";
$sql .= "`password` = md5('{$aAff['password']}') ";
$sql .= "WHERE `id` = '{$local}'";
so what your saying is adding the \ in the appropriate places for each of these functions will allow for escape and prevent injection...
Don't do it by
rote. You need to understand
what the hacker could possibly do with bad input, and guard against it appropriately. Sometimes it's just running the input through addslashes() so that ' in the input doesn't actually
end the term in the SQL statement (with more stuff following that does bad things). Other times you may need to do other things -- there are many tools in the toolbox.
