SQL injection in PHP with a CodeIgniter midleware

Question

SQL injection in PHP with a CodeIgniter midleware

Navigation

#1 by (3 votes)

0

I'm with a question with a function to prevent SQL injection:

public function f_LIMPIARINPUT($a_variable) {
    $valor = $a_variable;
    $valor = str_ireplace("SELECT", "", $valor);
    $valor = str_ireplace("FROM", "", $valor);
    $valor = str_ireplace("TABLE", "", $valor);
    $valor = str_ireplace("COUNT(*)", "", $valor);
    $valor = str_ireplace("(", "", $valor);
    $valor = str_ireplace(")", "", $valor);
    $valor = str_ireplace("INSERT", "", $valor);
    $valor = str_ireplace("INTO", "", $valor);
    $valor = str_ireplace("VALUES", "", $valor);
    $valor = str_ireplace(",", "", $valor);
    $valor = str_ireplace("COPY", "", $valor);
    $valor = str_ireplace("DELETE", "", $valor);
    $valor = str_ireplace("DROP", "", $valor);
    $valor = str_ireplace("DUMP", "", $valor);
    $valor = str_ireplace(" OR ", "", $valor);
    $valor = str_ireplace("%", "", $valor);
    $valor = str_ireplace("LIKE", "", $valor);
    $valor = str_ireplace("--", "", $valor);
    $valor = str_ireplace("^", "", $valor);
    $valor = str_ireplace("[", "", $valor);
    $valor = str_ireplace("]", "", $valor);
    $valor = str_ireplace("\", "", $valor);
    $valor = str_ireplace("!", "", $valor);
    $valor = str_ireplace("¡", "", $valor);
    $valor = str_ireplace("?", "", $valor);
    $valor = str_ireplace("=", "", $valor);
    $valor = str_ireplace("&", "", $valor);
    $valor = str_ireplace("'", "", $valor);
    $valor = str_ireplace("AND", "", $valor);
    $valor = str_ireplace("IS", "", $valor);
    $valor = str_ireplace("NULL", "", $valor);
    $valor = str_ireplace(";", "", $valor);
    $valor = str_ireplace("C:fakepath", "", $valor);
    return $valor;
}

Do you think it could be this way?

seguridad php codeigniter

asked by Christian Miranda Zambrano 15.03.2018 в 16:43

source

1 answer

How to Modify Data Stored in a Vector C ++ How to align icons in the cells

score 3 · Accepted Answer

CodeIgniter escapes and cleans variables that are passed to $this->db->query if passed through < a href="https://www.codeigniter.com/userguide3/database/queries.html#query-bindings"> bindings . But it does not escape if what you do is generate a dynamic SQL statement concatenating strings (although it does have some methods to clean / clean tickets such as $this->db->escape() , $this->db->escape_str() or $this->db->escape_like_str() ).

The method of bindings is better, because it is like using prepared queries (they are prepared queries). Your function seems to be to pass it to the input in dynamic queries and that is not recommended because the function is not safe, and it is a bad idea for several reasons:

There are ways to skip the validation by breaking and composing the forbidden words. Unless you pass this function until the result of two consecutive times is the same, you may have problems. For example, by removing the invalid words once, you could pass a string like:

SELSELECTECT * FRFROMOM tabla -&-

that after the function would stay in:

SELECT * FROM tabla --

allowing injection.

Consider dangerous words that are not and that would be valid. For example, imagine that the variable you want to clean is the name of a person (a fairly common fact in a form) and that person is called "Andy", after passing the value to your function, by this rule:

$valor = str_ireplace("AND", "", $valor);

the person that you contact now is called "and" to dry.

Does not consider dangerous words that are . This is a problem when using blacklists: if for whatever reason a dangerous word / term is not added, that word / term will skip the validation.

And not everything in SQL injection is someone trying to read your data. What happens if you want to access your account? Or create a new account? The validation rules you have set will not clean these words: CREATE , USER , @ , IDENTIFIED BY ; nor are these others: GRANT , ALL , PRIVILEGES , ON , *.* , TO ... that could allow creating a user and give total access to the system.