The Datafake Blog

Post Page Rank

• If using $_GET or $_POST variables in an mysql query, clean them with mysql_real_escape_string.
• When displaying user submitted content from the database, apply htmlentities before it is displayed.

SQL Injection - mysql_real_escape_string()

Using mysql_real_escape_string stops malicious inputs breaking SQL queries. The quote ‘ is a reserved character in SQL. When it appears as part of a parameter it can break or change the meaning of a query. The mysql_real_escape_string function escapes the quote ‘ so it becomes \’ SQL will not treat the quote as a reserved character and it can safely be used in a parameter usually to insert a quote into the DB.

XSS - Htmlentities()

Htmlentities turns characters into their equivalent html entities. This allows javascript code to be displayed in a page without the browser executing it. If a user enters some javascript into a form on your site and you display it back to them unaltered then the code will execute leaving you open to a scripting attack.

If I enter this into a form field on a web site:

<script>alert(”Your site executed my code. Thanks”);</script>

and the next page displays it without applying htmlentities, the browser will execute it and pop open an alert message box.

The consequences are worse if the input is stored and displayed again to another user. In this example that user would also see the alert message box pop open. The malicious script has access to private data that the browser stores for that user.

An html entity is a representation of a character. for example the < less-than sign’s html entity is &lt;. Applying htmlentities() replaces characters in the above javascript with their equivalent html entities to give.

<script>alert("Your site executed my code");</script>

When the browser encounters this it will decode the characters and display it in its original form but without executing the javascript it represents.

Tags: Security

This entry was posted on Tuesday, October 28th, 2008 at 11:10 pm and is filed under PHP. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.