Page 1 of 1
How to protect from script injections
Posted: Wed Dec 22, 2010 10:59 pm
by Baseball435
hey everyone. I asked my friend to test my site to see if it is protected enough and he said he could do script injection.
Like:
and i dont know how to protect from that. So how do i? My_real_escape_string doesnt work.
Re: How to protect from script injections
Posted: Thu Dec 23, 2010 5:46 am
by Jackolantern
Check out the PHP function
htmlentities. It will turn components required for cross-site-scripting, such as < and > into < and > so they will display their characters instead of process them.
All user-submitted input that will be displayed need to go through this as well as other data sanitization techniques. Google "PHP data sanitization" for many resources and scripts for what else you need to do. Mysql_real_escape_strings is mainly used for removing SQL injection attacks from data to be entered into the database.
Re: How to protect from script injections
Posted: Thu Dec 23, 2010 1:50 pm
by hallsofvallhalla
thanks I was actually looking for some related info on this as well.
Re: How to protect from script injections
Posted: Thu Dec 23, 2010 2:14 pm
by ConceptDestiny
Is there a way of combining Mysql_real_escape_strings with htmlentities, bascially to protect against both?
Re: How to protect from script injections
Posted: Thu Dec 23, 2010 3:28 pm
by Chris
It's best to use htmlentities when echoing information from the database and not sotring the escaped string in the database. This saves memory and is also easier for searching information withing the database if needed.
You could of course easily do that:
Code: Select all
$string = htmlentities(mysql_real_escape_string($string));
Re: How to protect from script injections
Posted: Fri Dec 24, 2010 1:32 am
by Baseball435
Thanks guys. And yeah I hope that you use this for your game, halls. So that my friend won't try hacking again
Re: How to protect from script injections
Posted: Fri Dec 24, 2010 3:23 am
by Callan S.
This sanitisation strikes me as just being required because the whole DB handling method is badly designed. I mean, basically how it is interacting with the database is that it mixes both commands and data into one string. I mean, it's kind of asking for trouble when they made database connections that way! If there was a seperate string for data that would only ever, ever be treated as data, then you wouldn't need to sanitise.
Honestly, every time I see a santisation thread it seems to have some new command involved. Where does it all end, eh? So far I've picked up strip_tags && mysql_real_escape_string methods. It gets to be like collecting pokemon...gotta catch sql all...or else...
Re: How to protect from script injections
Posted: Wed Jan 26, 2011 11:39 pm
by Gate
Make a function in your common includes file as such:
Code: Select all
<?php
function secure_input($input){
$input = htmlentities($input);
$input = mysql_real_escape_string($input);
//anymore security stuff do here
}
?>
then you can just do:
Code: Select all
<?php
$query = "SELECT * FROM members WHERE id=1"
$query = secure_input($query);
?>
you can then just reuse:
when needed
Re: How to protect from script injections
Posted: Thu Jan 27, 2011 5:55 am
by PaxBritannia
I just use
Code: Select all
function saq($string)
{
$string = mysql_real_escape_string($string);
return $string;
}
$var=saq($var);
mysql_real_escape should sanitise most things.
pax.
Re: How to protect from script injections
Posted: Thu Jan 27, 2011 5:06 pm
by Jackolantern
mysql_real_escape_string() does not prevent cross-site-scripting, as that is not its intended purpose. If you read the PHP Manual entry, it actually only deals with a handful of characters, and none of them are the greater-than or less-than signs (the ones you have to defeat to prevent XSS), nor does it do anything that changes the display of the text in the browser (it prepends slashes, but doesn't convert any HTML entities). To prevent XSS, you have to use htmlentities() or one of its relatives.