Hello and welcome to our community! Is this your first visit?
Register
Enjoy an ad free experience by logging in. Not a member yet? Register.
Results 1 to 7 of 7
  1. #1
    Regular Coder
    Join Date
    Oct 2009
    Posts
    438
    Thanks
    9
    Thanked 7 Times in 7 Posts

    External Scripts Adding data to my DB

    All,
    I have the following URL:
    http://tinyurl.com/3dlrcfj

    I have the javascript validation on the front end and I check on the backend to see if the page was posted by using something like the following:
    PHP Code:
    if($_POST){
    //assign to variable and then insert into database

    However, for some reason scripts are getting around the validation of the JS (I know because it's inserting "select" into my database for the Run type and it doesn't seem that my reCaptcha isn't working because I'm getting a TON of Cialis and crap like that being inserted into my database. Any ideas on what is going on and how to stop it?? Thanks in advance.

  • #2
    Banned
    Join Date
    Feb 2011
    Posts
    2,699
    Thanks
    13
    Thanked 395 Times in 395 Posts
    Javascript validation on it's own, because it can very easily be bypassed, is essentially useless in preventing bogus data being sent to a server side script as you are finding out.

    it sounds like you are a victim of SQL Injection (it could be harmless or malicious) - sql injection example code

    Server-side validation/sanitisation of every user input is a "must do" before any user inputs are used in a database query/command.

    I don't click links in posts anymore (my Trend Micro detected a "nasty" in one recently) so it might help me, and maybe others, if post your server side code.

    Based on your snippet of code, it appears you probably have no where near sufficient server side validation/sanitisation.
    Last edited by bullant; 06-01-2011 at 05:00 AM.

  • #3
    Regular Coder
    Join Date
    Oct 2009
    Posts
    438
    Thanks
    9
    Thanked 7 Times in 7 Posts
    Thanks, I agree it is a SQL injection. Does anyone have any good cleansing code to use from a simple POST?

    I usually do something like:
    PHP Code:
    $first_name mysql_real_escape_string($_POST['first_name']); 

  • #4
    Regular Coder
    Join Date
    Jul 2010
    Location
    Sheffield
    Posts
    827
    Thanks
    93
    Thanked 18 Times in 18 Posts
    That would be good enough to clean data against SQL injection however i also check length (look at strlen) to make sure the inputted data is suitable e.g.

    PHP Code:
    if ($strlen($_POST['first_name'] > 2) {
    $name mysql_real_escape_string($_POST['first_name']);
    }else {
    echo 
    "First name isnt long enough";

    That way someone couldn't just enter A as a name. Also look a regex for checking an email address format if you store email addresses.

  • #5
    Senior Coder
    Join Date
    Feb 2011
    Location
    Your Monitor
    Posts
    4,358
    Thanks
    61
    Thanked 530 Times in 517 Posts
    I wonder what would happen if BA Barracus tried to sign up at your site then tomharto?

    Names with just 2 characters do exist in the real world too..
    See my new CodingForums Blog: http://www.codingforums.com/blogs/tangoforce/

    Many useful explanations and tips including: Cannot modify headers - already sent, The IE if (isset($_POST['submit'])) bug explained, unexpected T_CONSTANT_ENCAPSED_STRING, debugging tips and much more!

  • #6
    Regular Coder
    Join Date
    Jul 2010
    Location
    Sheffield
    Posts
    827
    Thanks
    93
    Thanked 18 Times in 18 Posts
    That was a bad example, i usually do over 7 for a username but seeing as he posted about first name i stuck with that but yeah strlen on a first name isnt a great idea :P

  • #7
    Senior Coder
    Join Date
    Feb 2011
    Location
    Your Monitor
    Posts
    4,358
    Thanks
    61
    Thanked 530 Times in 517 Posts
    strlen on any name isn't a good idea.

    Its also nothing to do with SQL injection.
    See my new CodingForums Blog: http://www.codingforums.com/blogs/tangoforce/

    Many useful explanations and tips including: Cannot modify headers - already sent, The IE if (isset($_POST['submit'])) bug explained, unexpected T_CONSTANT_ENCAPSED_STRING, debugging tips and much more!


  •  

    Posting Permissions

    • You may not post new threads
    • You may not post replies
    • You may not post attachments
    • You may not edit your posts
    •