How to protect from script injections

[Baseball435]

hey everyone. I asked my friend to test my site to see if it is protected enough and he said he could do script injection.

Like:

Code: Select all

<script> alert("hi"); </script>

and i dont know how to protect from that. So how do i? My_real_escape_string doesnt work.

[Jackolantern]

Check out the PHP function htmlentities. It will turn components required for cross-site-scripting, such as < and > into < and > so they will display their characters instead of process them. All user-submitted input that will be displayed need to go through this as well as other data sanitization techniques. Google "PHP data sanitization" for many resources and scripts for what else you need to do. Mysql_real_escape_strings is mainly used for removing SQL injection attacks from data to be entered into the database.

[hallsofvallhalla]

thanks I was actually looking for some related info on this as well.

[ConceptDestiny]

Is there a way of combining Mysql_real_escape_strings with htmlentities, bascially to protect against both?

[Chris]

It's best to use htmlentities when echoing information from the database and not sotring the escaped string in the database. This saves memory and is also easier for searching information withing the database if needed.

You could of course easily do that:

Code: Select all

$string = htmlentities(mysql_real_escape_string($string));
 

[Baseball435]

Thanks guys. And yeah I hope that you use this for your game, halls. So that my friend won't try hacking again

[Callan S.]

This sanitisation strikes me as just being required because the whole DB handling method is badly designed. I mean, basically how it is interacting with the database is that it mixes both commands and data into one string. I mean, it's kind of asking for trouble when they made database connections that way! If there was a seperate string for data that would only ever, ever be treated as data, then you wouldn't need to sanitise.

Honestly, every time I see a santisation thread it seems to have some new command involved. Where does it all end, eh? So far I've picked up strip_tags && mysql_real_escape_string methods. It gets to be like collecting pokemon...gotta catch sql all...or else...

[Gate]

Make a function in your common includes file as such:

Code: Select all

<?php

function secure_input($input){
     $input = htmlentities($input);
     $input =  mysql_real_escape_string($input);
     //anymore security stuff do here
}

?>

then you can just do:

Code: Select all

<?php
$query = "SELECT * FROM members WHERE id=1"
$query = secure_input($query);

?>

you can then just reuse:

Code: Select all

secure_input();

when needed

[PaxBritannia]

I just use

Code: Select all

function saq($string)
{ 
  $string = mysql_real_escape_string($string);
  return $string;
}
$var=saq($var);

mysql_real_escape should sanitise most things.

pax.

[Jackolantern]

mysql_real_escape_string() does not prevent cross-site-scripting, as that is not its intended purpose. If you read the PHP Manual entry, it actually only deals with a handful of characters, and none of them are the greater-than or less-than signs (the ones you have to defeat to prevent XSS), nor does it do anything that changes the display of the text in the browser (it prepends slashes, but doesn't convert any HTML entities). To prevent XSS, you have to use htmlentities() or one of its relatives.