Subscribemysqli_query - what are you putting in as the first parameter? What does mysqli_query return? What does extension_loaded("mysqli") return?mysqli_query() does not work, and extension_loaded("mysqli") returns false.mysql_real_escape_string does the job. I don't think you can use stored procedures without mysqli though.$_SERVER["REQUEST_URI"] anywhere, remember to run htmlentities() on it to protect against cross-site scripting attacks.$_SESSION['logged_in']='true' session_start();
session_regenerate_id();
if ($_SESSION['logged_in']=='true') {
//do authorised stuff
} else {
exit('you must be logged in to do that');
} I second the mysqli recommendation as a replacement for mysql_real_escape_string. the absolute best way to avoid sql injection is using a parameterized query.This is extremely good advice. I have to cringe whenever people do all this manual and potentially error-prone escaping when they could just use parameterized queries. They also look much nicer... in languages where proper MySQL modules was not an afterthought like PHP. Compare in perl:
$dbh->do("UPDATE userDB SET foo=?, bar=? WHERE user=?", undef, $foo, $bar, $user);vs.$dbh->do("UPDATE userDB SET foo='" . $dbh->quote($foo) . "', bar='" . $dbh->quote($bar) . "' WHERE user='" . $dbh->quote($user) . "'");Nearly everyone survives without mysqli so it's not a great loss. mysql_real_escape_string does the job.Yes of course. This is a perfect example of what turns people off from PHP. It's just not clean. It's a dirty little combination of crap that was thrown together without thought or real design. The familiar "mysql" module doesn't even have the capability to do parameterized SQL -- somebody must have said, "nah, doesn't sound important, it's not something I use, so why bother." And of course that is the module that became de-facto, so everyone uses it to the point where the rewritten and "improved" mysqli is almost impossible to find on stock systems. Mediocrity prevails, and consequently people grow up on PHP thinking that escaping is something that has to be done manually (and is therefore often neglected.)
I am quite astonished how hard it is to find any kind of comprehensive PHP security advice on the net (written for the general reader), or even in a book.One way to learn about these things is to study vulnerabilities in existing PHP software that have been reported. Here is a good place to start. Also, consider selecting a package that historically has had a lot of vulnerabilities (phpBB is the quintessential example) and then search the archives of bugtraq or full-disclosure and look at the vulns reported against that package.
You are not logged in, either login or create an account to post comments
Just turn off register_globals. You don't need it for anything else but legacy apps.
convert everything to entities
This is crap. You need to work out which strings are text (without entities) and which are HTML (with entities). The best thing to do is to store everything as text and convert it to HTML on output.
posted by cillit bang at 12:05 AM on March 31, 2006