4 ms·

Yeah, that was my immediate thought. Something like this: $delete = "DELETE FROM `cart` WHERE id='$id'"; Which is currently among the top three, could be pre

by nkozyra 10y ago

Yeah, that was my immediate thought. Something like this: $delete = "DELETE FROM `cart` WHERE id='$id'"; Which is currently among the top three, could be prefaced by the built in mysqli escape function or at minimum cast to (int). This is not a great approach, the query should be prepared, but it's not inherently an injection risk based on that snippet alone. And the underlying functions come from the C library for MySQL. Almost any language's SQL libraries will allow you to send an arbitrary string to the database. This is not a PHP problem by any measure.

dep_b 10y ago
Perhaps it's the whole mindset. Why even use that when you have perfectly fine built in mechanisms for SQL parameters for over a decade? I wouldn't even start writing a query like that. You can do stuff like that too in a .Net / SQL stack for example (or in Django) but somehow everybody defaults to Entity framework or similar solutions that take care of it. I'm way too lazy to deal with lines and lines of sanitizing, raw queries and mysql_blahblahblah anyway so I write wrappers that give me the results from a query and a bunch of parameters in one line. Secure. Simple.
- flomo 10y ago
  If you google "PHP MySQL", you can find all sorts of horrible tutorials like [1] teaching you to write SQL injections. So unlike users of other languages, PHP programmers are taught the wrong way first and then are expected to figure it out somehow. [1] http://www.freewebmasterhelp.com/tutorials/phpmysql/7 http://www.freewebmasterhelp.com/tutorials/phpmysql/7
  - towindontplay 10y ago
    That website is from 2001 though
    - DCoder 10y ago
      The bigger problem is that Google ranks that website higher than the modern stuff. You can make much better tutorials and it won't help as long as that legacy cruft is sitting at the top of every newbie's search results.
      - dep_b 10y ago
        True. I notice that I filter Google results on last year only just to filter out outdated stuff. Just today I wondered why everything on the web (read: Google) was getting so old.
zdragnar 10y ago
No operation with side effects should ever be run without validation- you could cast to an int, sure, but unless you validate the user is allowed to delete that particular int, you're still giving them free reign over your entire cart table. The biggest trouble with these questions is that people are learning many aspects of web development without understanding the separate concerns they should be aware of when heading to production code. It's difficult to (a) avoid over-answering and explaining everything while also (b) avoid giving insecure advice
- masklinn 10y ago
  > you could cast to an int, sure, but unless you validate the user is allowed to delete that particular int, you're still giving them free reign over your entire cart table. That's a completely different issue and not an SQL injection error though.
  - zdragnar 10y ago
    What should have been invalid input has been turned into valid input, but the valid input doesn't reflect the user's intent. As a result, the behavior is undefined. Best case scenario, nothing happens. Worst case, random rows are deleted. Personally, I don't think introducing undefined behavior is ever good advice, even if it is technically correct advice. All of this really just gets at my original point, though: there are so many things for new developers to learn that it is extremely difficult to provide good answers on a forum like SO. That doesn't diminish the value, but we have to be aware of, accept, and make clear this fact.
masklinn 10y ago
> Which is currently among the top three, could be prefaced by the built in mysqli escape function or at minimum cast to (int). OTOH it is entirely unnecessary to quote integers (and the escaping function would not quote it before injecting it), so outlook not so good.
- nkozyra 10y ago
  Yes, it's unnecessary, but it doesn't cause a problem for MySQL. I've seen lots of people do that though I don't know their rationale. Maybe they just don't know SQL
  - masklinn 10y ago
    > Yes, it's unnecessary, but it doesn't cause a problem for MySQL. It's not necessary in any DB, SQL specifies coercion of any value when the expected data type is unambiguous (and in a bunch of other cases, SQL is pretty weakly typed all in all).
    - nkozyra 10y ago
      But again, it's not causing harm.

by nkozyra 10y ago

dep_b 10y ago

Perhaps it's the whole mindset. Why even use that when you have perfectly fine built in mechanisms for SQL parameters for over a decade? I wouldn't even start writing a query like that. You can do stuff like that too in a .Net / SQL stack for example (or in Django) but somehow everybody defaults to Entity framework or similar solutions that take care of it. I'm way too lazy to deal with lines and lines of sanitizing, raw queries and mysql_blahblahblah anyway so I write wrappers that give me the results from a query and a bunch of parameters in one line. Secure. Simple.

flomo 10y ago
If you google "PHP MySQL", you can find all sorts of horrible tutorials like [1] teaching you to write SQL injections. So unlike users of other languages, PHP programmers are taught the wrong way first and then are expected to figure it out somehow. [1] http://www.freewebmasterhelp.com/tutorials/phpmysql/7 http://www.freewebmasterhelp.com/tutorials/phpmysql/7
- towindontplay 10y ago
  That website is from 2001 though
  - DCoder 10y ago
    The bigger problem is that Google ranks that website higher than the modern stuff. You can make much better tutorials and it won't help as long as that legacy cruft is sitting at the top of every newbie's search results.
    - dep_b 10y ago
      True. I notice that I filter Google results on last year only just to filter out outdated stuff. Just today I wondered why everything on the web (read: Google) was getting so old.

zdragnar 10y ago

No operation with side effects should ever be run without validation- you could cast to an int, sure, but unless you validate the user is allowed to delete that particular int, you're still giving them free reign over your entire cart table. The biggest trouble with these questions is that people are learning many aspects of web development without understanding the separate concerns they should be aware of when heading to production code. It's difficult to (a) avoid over-answering and explaining everything while also (b) avoid giving insecure advice

masklinn 10y ago
> you could cast to an int, sure, but unless you validate the user is allowed to delete that particular int, you're still giving them free reign over your entire cart table. That's a completely different issue and not an SQL injection error though.
- zdragnar 10y ago
  What should have been invalid input has been turned into valid input, but the valid input doesn't reflect the user's intent. As a result, the behavior is undefined. Best case scenario, nothing happens. Worst case, random rows are deleted. Personally, I don't think introducing undefined behavior is ever good advice, even if it is technically correct advice. All of this really just gets at my original point, though: there are so many things for new developers to learn that it is extremely difficult to provide good answers on a forum like SO. That doesn't diminish the value, but we have to be aware of, accept, and make clear this fact.

masklinn 10y ago

> Which is currently among the top three, could be prefaced by the built in mysqli escape function or at minimum cast to (int). OTOH it is entirely unnecessary to quote integers (and the escaping function would not quote it before injecting it), so outlook not so good.

nkozyra 10y ago
Yes, it's unnecessary, but it doesn't cause a problem for MySQL. I've seen lots of people do that though I don't know their rationale. Maybe they just don't know SQL
- masklinn 10y ago
  > Yes, it's unnecessary, but it doesn't cause a problem for MySQL. It's not necessary in any DB, SQL specifies coercion of any value when the expected data type is unambiguous (and in a bunch of other cases, SQL is pretty weakly typed all in all).
  - nkozyra 10y ago
    But again, it's not causing harm.