49 ms·
Google results for PHP tutorials contain SQL injection vulnerabilities
- l0b0 5y agoI googled for `php mysql email register`. This returns tutorials, how-tos, code snippets. Most results include flawed DB statements. Nothing to do with Google itself, Google being vulnerable to SQL injection, or completely arbitrary websites being vulnerable.
- phil294 5y agoOh I see what you mean, I rephrased the title a bit. It is pretty specific after all
- ChuckMcM 5y agoPretty much. The best way to insert supply chain exploits is to embed them in a stack exchange answer to a beginner's question. This isn't new, we've always had programmers who programmed by "recipe" rather than first principles, and DRY paints that as a feature, but it underlies a lot of pain and cost over the years. To give some context, I inherited some kernel code when I worked in the Systems Group at Sun Microsystems in the 80's that was written by a mathematician who had become a programmer because the money was in programming, not applied math. They had cut and pasted code they didn't understand in order to achieve the result they wanted out of the code they were "writing." When I inherited it I read through it and found a couple of dozen ways the code would panic the kernel[1]. Once fixing those obvious issues, it became clear that the original owner of the code didn't really understand what computation did. They had an idea, and mathematically they could show that it was correct, but literally no ability to express that algorithmically. This is not a "new" problem but it is an important one that managers of software engineers need to watch for. [1] At the time the only difference between "kernel" programmers and "application" programmers was that kernel programmers recognized that unsafe code crashed the whole system, not just the application. So they tended to be cultivated from paranoid programmers.
- pvg 5y agoThe best way to insert supply chain exploits is to embed them in a stack exchange answer to a beginner's question. None of these answers seem to come from SE so this might be harder than you might assume.
- Godel_unicode 5y agoIt's not. Note that these threads are a few years old, but in recent research (stay tuned!) it has if anything gotten worse. https://news.ycombinator.com/item?id=13099690 https://news.ycombinator.com/item?id=13099690 https://laurent22.github.io/so-injections/ https://laurent22.github.io/so-injections/
- pvg 5y agoIt may have but this research doesn't show that. It appears to be in questions, rather than answers, when I can find a page that hasn't been removed. Beside most of these not actually being there, the google result is for answers which additionally have been ranked by Google. The thing you link is not meaningfully comparable to the Google result, nor is it representative of 'if you search for something on SE, how often does it tell you to put SQLI in your code'.
- latchkey 5y ago> The best way to insert supply chain exploits is to embed them in a stack exchange answer to a beginner's question. I'd love to see a concrete example of this happening in this way! The rest of your story just describes 'smart, but bad jr. programmer' and doesn't really discuss the exploit issue.
- treeman79 5y agoThought the best way was to develop a basic and easy library. Then upload a malicious binary that doesn’t match the source. There was a really good post on how to do it and evade detection.
- kadoban 5y agoIn PHP's case, Stack Exchange is not necessary to get SQL injected tutorials. The official docs for _years_, if not decades, included them. The docs for how you were supposed to do SQL were just full of the antipattern of building queries by string formatting and concatenation. I wouldn't be surprised if some dark corner of the docs still had those available.
- 0x0nyandesu 5y agoGenerally speaking lesson 1 on building queries skips over injections and only after the basic premise is explained do you go into the details on how to be secure in lesson 2.
- nneonneo 5y agoAnd tons of people skip lesson 2 thinking they’ve got it, go on to make websites which seem to work, and then get pwned by script kiddies down the road. SQL injections are incredibly easy to test for, and exploit scripts like SQLmap make it trivial to dump an entire database server’s contents with a single point of entry (and, if you’re unlucky, tamper with or even delete your databases). There’s practically no excuse for not covering it in a tutorial, or at least giving some forewarning about it.
- iratewizard 5y agoAmit Singhal's method for maintaining Google's search business unit was its success. Hopefully they realize the ML pipe dream is a failure sooner than later.
- iamstupidsimple 5y agoCare to elaborate on how Amit ran things differently?
- iratewizard 5y agoSearch rules were written by hand and not left to an automatic process
- crummy 5y agowere there less SQL injection vulnerabilities in the search results back then?
- iratewizard 5y agoYes. Search as a whole was a far superior level of quality. Today's Google search is as bad as Yahoo's search in the early 00s.
- ma2rten 5y agoThis doesn’t seem like something that could be fixed by using a rule based approach, because it would require actually understanding the subject matter.
- paul_f 5y agoI don't have a problem with this. If I am trying to figure out how to do something, I'd rather the help be focused on the thing, and not confuse my by adding the mysqli_real_escape_string stuff. Yes, I know about little bobby tables and all that. Same with trying to see an example of a php form. I don't need the csrftoken, I already know to do that. Yes, it might help a novice, but don't make everything more complicated just for beginners benefit
- TeMPOraL 5y ago> If I am trying to figure out how to do something, I'd rather the help be focused on the thing, and not confuse my by adding the mysqli_real_escape_string stuff. In this case, the help is fundamentally wrong. Other than "what is an example of a dumb programming mistake?", there aren't really questions to which a valid answer involves concatenating arbitrary strings and executing the result as an SQL command. If your question is, "how do I execute an SQL command?", there are many better examples to use. If the question is, "how do I store user-supplied data in the database?", or "how do I query using user-supplied values", then the answer should not give you what amounts to an accidentally working hack. SQL is a language of its own. It has a syntax and a grammar. When generating SQL from PHP (or any other language), you're switching languages - there must be a translation step involved. Any answer that doesn't bring this up explicitly is just wrong.
- mgkimsal 5y ago> "... and not confuse my by adding the mysqli_real_escape_string stuff... CSRF token ...I already know to do that..." If you're already that good, how does seeing a CSRF token in an answer actually impact you? Does it prevent you from copy/pasting someone's "example" code?
- gregjor 5y agoI freelance fixing and maintaining legacy web apps, almost always PHP. Anecdotally I see SQL injection vulnerabilities in about half the code I look at. It’s one type of problem among many other problems and vulnerabilities in code written by amateurs and often copy/pasted. PHP programmers can find lots of resources online. Some of those are terrible, either very old or written by amateurs excited to show how they got something to work. I have seen the same kind of thing with Java and Python, but the popularity of PHP means there’s a lot of junk info and examples online. PHP has supported safe SQL and safe HTML for decades, but the programmer has to understand the problem and the solution.
- cosmodisk 5y agoFrom my anecdotal data, a whole lot of tutorials are written by 'learn Java in 21 day' stage developers. People are excited, want to put their name out there and start churning out tutorials on concepts only yesterday they had no clue about. Similar situation with many online courses too.
- gerdesj 5y agoI run a small IT company and the Windows sysadmin stock answer to nearly all problems: C:\Windows\System32> sfc /scannow ... followed by "reinstall your operating system". OK so no harm done apart from rather a lot of downtime, assuming you can put it back together again. The number of times I see "disable your AV" still is frightening. I have a browser plugin that I discovered thanks to this parish called uBlacklist which you can use to try and clean up your search results by banning known bad sites from your results. social.microsoft.whatever was first ... 8) I also note an awful lot of Linux related link farms and "blogs" with ads and cloned content from other sources have surfaced over the last few years. WordPress is another quagmire. I could go on but basically, search is very close to completely screwed (but not quite.)
- syshum 5y agoNow Now... The Sysadmin stock answer to nearly all problems is shutdown /r /t 0 If that fails, then sfc /scannow
- lixtra 5y agoThe clean code may still have other issues. For example [1] give away if a certain email address is registered with the site or not. [1] https://phppot.com/php/user-registration-in-php-with-login-form-with-mysql-and-code-download/ https://phppot.com/php/user-registration-in-php-with-login-f...
- IshKebab 5y agoEveryone on HN is obsessed with that "vulnerability" without considering that: a) almost all sites that try to avoid it fail anyway when you try to sign up - "that email is already registered" and b) it's really user-hostile for a tiny increase in privacy so it's perfectly reasonable to not implement it on most sites.
- hsbauauvhabzb 5y agoThis. Risk assess whether user enumeration is actually bad, the go fix it if you need to.
- jffry 5y agoIf I did want to close that hole, is there anything more clever than just having a username that isn't an email address, and allow more than one account to use the same email address?
- ghusbands 5y agoI don't think people in general want to remember a username for every site.
- isbvhodnvemrwvn 5y agoJust return the usual "please confirm registration by clicking a link in the email" - in the e-mail you just notify the email owner that someone tried to create a new account while another account was already registered for this e-mail. This does not disclose anything to anyone other than the owner of the e-mail.
- 5y ago
- stabbles 5y agoLooking forward to statistics on vulnerabilities in Copilot suggestions
- haolez 5y agoProgramming in PHP using GitHub's Copilot must be exciting :)
- ineedasername 5y agoIn a few years we might regard it the same way as MS Office's Clippy: "It looks like you're trying to create a web app front end! Do you need assistance with A) Implementing a dark pattern or B) Avoiding the use of dark patterns?"
- why_only_15 5y agoso true
- hermitdev 5y agoIt makes one wonder: was copilot development started before or after MS's acquisition?
- CR007 5y agoI feel that it actually understand what I'm doing. Is very wicked how sometimes copilot nails a line or an entire block totally in my context and writing style. Scary stuff.
- dvh 5y agoPeople have been warning us about sql injection for more than 2 decades, it finally start to pay off and then someone in js invents div.innerHTML=`template aka glued strings` and everybody jumps on it like it's no big deal.
- opheliate 5y agoI’m not sure what point you’re making here? IMO, while JS is certainly more bloated than ever as a result, the current popularity of frameworks like React, Vue, etc. makes it much less likely that a beginner will introduce XSS than 10 years ago.
- paulddraper 5y agoThe existence of `innerHtml` or `eval()` or `exec()` etc isn't the problem itself. After all, you could implement the exact same thing in userspace. But yes, anytime you have one program writing instructions for the other, you wind up with a risk for bad composition of those instructions. Fortunately, frameworks and libraries (for SQL and HTML) are increasingly successful at adoption and removing the risk of the programmer using low-level unsafe primitives.
- tomohawk 5y agoIt would seem that misinformation such as this would be much more in the wheelhouse of companies such as Google as they consider censoring content and twiddling search results. They don't employ virologists, or other experts, but they regularly label information that they have little inside technical expertise on as misinformation. With so much obvious misinformation on stack exchange, why is Google so blase about directing searchers to the site?
- bronzeage 5y agoBecause Google doesn't label misinformation because Google really wants to, but because it's pushed by the government under the guise of "just a private company". It's supposed to be unconstitutional to have your government censoring things, but covid-19 is the catch all excuse for any authoritarian violation these days.
- yourenotsmart 5y agoImagine seeing this in your search results: In order to show you the most relevant results, we have omitted some entries that contain shitty code and bad security practices. If you like [repeat the search with the omitted results included]. I can't imagine this being controversial. No one would complain at all about being affected.
- laurent123456 5y ago50% is also what I had found on Stackoverflow (2018) - https://laurent22.github.io/so-injections/ https://laurent22.github.io/so-injections/
- cmeacham98 5y agoThe top code snippet in the "latest vulnerabilities" section (as of the time of writing) is: $query = "SELECT * FROM wp_misure WHERE Id = '".mysqli_real_escape_string($link, $_GET['id'])."'"; This is not vulnerable to SQLi unless I misremember how real_escape_string works.
- laurent123456 5y agoYes it's not 100% accurate but still gives a good approximation. See there for more info https://github.com/laurent22/so-sql-injections/issues https://github.com/laurent22/so-sql-injections/issues
- wruza 5y agoI always wondered if “real_” means “now this time we’re serious” or something less funny.
- lillesvin 5y agoIt seems to come from the MySQL C API: https://dev.mysql.com/doc/c-api/8.0/en/mysql-real-escape-string.html https://dev.mysql.com/doc/c-api/8.0/en/mysql-real-escape-str... The 'real' supposedly alludes to the fact that `mysql_real_escape_string()` accounts for character encoding (if specified correctly) unlike its sibling `mysql_escape_string()`. So, yeah, I'm afraid 'less funny'. :-/
- acdha 5y agoI generally reject that in review because it perpetuates thinking of the problem as needing to sprinkle escape calls around rather than using a systemic fix. I’ve seen a number of cases where this resulted in various errors because the escaped value was later manipulated in some way - I don’t believe any of those were exploitable but they caused user reports of broken formatting or crashes.
- ineedasername 5y agoI don't blame google for this. I blame crappy tutorials that either gloss over important details or are written by people who don't know them in the first place. If Google could develop a search algorithm that selected results for quality code, they'd have an entirely separate product they could sell, perhaps as part of an "AI Cloud" assisted programming environment.
- nwellnhof 5y agoI'm pretty sure all these crappy tutorials only appear in the top results because of shady SEO tricks. Do you really think these are "authority" sites which Google claims to rank highest? It's a sad fact that Google is still unable to stop black-hat SEO, so they are at least partly to blame.
- tester756 5y agoPeople don't use ORMs there? Those are great tools and you can always use raw sql in exceptional cases
- GuB-42 5y agoUse an ORM if you want but parameterized queries work just as well preventing SQL injections ORMs are a heavyweight, something that is fundamental in your design. Parameterized queries are just regular SQL queries, but safer.
- AtNightWeCode 5y agoAll queries must in the end be parameterized I would say. Both for security and performance reasons.
- Zababa 5y agoSo what's the actual way of doing this in PHP?
- themodelplumber 5y agoThat really depends on whether you are using raw PHP or a CMS, CMF, or application framework. If it's any of the latter you should check with the development team. In many cases there are some great tools already provided for you by the frameworks, or there are helpful conventions that make things more efficient. If it's raw PHP I wouldn't want to compete with a lot of great SO results out there, but you also have to take into account circumstantial matters, like whether the given approach is appropriate to the needed output or input you are dealing with. For this reason I'd recommend arranging for some kind of code review even if you ask online strangers for input.
- mr-ron 5y agoLast I looked, it was to leverage the $mysqli->real_escape_string method.
- hu3 5y agoAll top frameworks support parameter binding. Same for PHP standard library like PDO or mysqli which also provide parameter binding. These eliminate SQL injection. But you have to use them and not just concatenate user input to SQL queries.
- acomjean 5y agoPDO. You write the query and insert the variables in a second step. I’ve been doing php 10+ years and that’s all we’ve been using. Or if your framework has an orm you can use that. There are pdo drivers for most popular databases https://www.php.net/manual/en/book.pdo.php https://www.php.net/manual/en/book.pdo.php Honestly it’s my favorite way of accessing databases (compared with Java Perl and python)
- tored 5y agoUsing prepared statements, with the PDO database driver it would be something like this $stmt = $pdo->prepare('INSERT INTO user (email) VALUES(?)'); $stmt->execute([$email]); For a full example you can look here, includes injection example https://3v4l.org/Fh2Pt https://3v4l.org/Fh2Pt
- soheil 5y agoI don't know, I feel like people love to pile on PHP nowadays. Do people actually think those who are learning PHP by searching Google for tutorials are going to be creating production ready applications that would be so critical that a simple SQL injection attack would be so catastrophic to? There will be a million other ways mistakes can be made before anything is up and running with actual users. Better a simple attack to wipe out their db early on instead of a more nuanced bug somewhere down the road that is so hard to catch because they're trying to figure out what stateless composition of a single purpose component means. At least PHP makes it simple to write some code and start thinking about what you want to do instead of total BS React style esoteric f*ckry. Let the poor newbies learn to code by seeing the simple beauty before drowning them in security nightmare scenarios.
- acdha 5y ago> Do people actually think those who are learning PHP by searching Google for tutorials are going to be creating production ready applications that would be so critical that a simple SQL injection attack would be so catastrophic to? Yes. I’ve seen this from highly-paid staff and contractors at multiple places in .com, .edu, and .gov. This includes commercial licensed software, big name consulting companies, and ostensible security experts. I’ve also seen them “fix” the problem by looking for the PoC test string and only rejecting that value. Unsafe defaults make it much easier to get something to “work” without noticing problems because the happy path works and is what most people focus on testing.
- fencepost 5y agoDo people actually think those who are learning PHP by searching Google for tutorials are going to be creating production ready applications that would be so critical that a simple SQL injection attack would be so catastrophic to? Abso-freakin-lutely. It may not be direct copy pasting of code, but often it'll start as that then be tweaked as appropriate for the project at hand. Even programmers not doing this are frequently going back and looking at their own code doing similar things or other similar code in codebases they have access to (eg internal libraries). Better programmers will do similar things but also recognize the flaws in what they're using.
- robertwt7 5y agoI still feel bad about the image of people towards PHP, but given the amount of bad tutorials and packages that are outdated out there I understand that most enterprise / startup wants to avoid having to code in PHP again. For the past couple of years I have been working with laravel in a small company, and I really enjoyed it. The environment that it provides honestly is amazing. Documentation is super easy to read, laracast is amazing to bootstrap your knowledge in couple of weeks, and community is huge that you can find almost anything already built by them. However its hard to find any big companies here that uses PHP, jobs popping up is mostly python, java and c#, thus sadly I have to leave php and learn java / python for the new big tech job (also for my own future). Its not that java / python community is bad, but I'll surely miss the laravel ecosystem.
- charrondev 5y agoI’m a tech lead for Vanilla Forums (recently acquired by Higher Logic). We have a few PHP positions open (remote or onsite). The core product is open source https://github.com/vanilla/vanilla https://github.com/vanilla/vanilla If your looking to stick with PHP you can check the open positions or reach out to my contact info in my profile. https://www.higherlogic.com/about/company/jobs/ https://www.higherlogic.com/about/company/jobs/
- paulddraper 5y ago> However its hard to find any big companies here that uses PHP There's one pretty big one....Faceledgar? Peoplebook? Something like that.
- lr4444lr 5y agoWow! That low a ratio?
- fencepost 5y agoBeat me to it. I'm astonished it's that low, and I suspect that if you look at books on PHP programming that are currently or recently "in print" you'll find a lot of examples in early chapters that do exactly the same thing.
- Cloudef 5y agoMy surprise too. When swift (the language) was still young and I had to use it. I looked for some ready made sql wrapper, and oh boy it had the standard sql injection vulnerabilities because it did not use prepared statements. I ended up writing my own thing. Guess the memory safe language could not help you here :)
- techbio 5y ago> Several of these results were, simply put, SEO-optimized baloney. My experience in the past couple of years as well, and not just for PHP. I wonder if anyone has looked into tutorial results with and without privacy controls to see if the quality is meaningfully different.
- gohbgl 5y agoSome time ago I found this video series on YouTube about how to build a PHP application from scratch. Ten hours worth of XSS, CSRF, SQL injection, badly coded authentication, you name it. When confronted, the instructor said that he did not want to confuse the beginners with all of that security stuff. I just thought "ok" and moved on. Now I went back to this guy's YouTube channel and saw that half a year later he finally did upload a bonus episode on how to mitigate SQL injections. One person in the comment section actually thanked him for the much needed video because their site was getting hacked. It is pretty hilarious to see this unfold but I do feel bad for the ~10k people who watched his videos.
- SilverRed 5y agoMaybe the solution here is to just have some kind of legal penalty to losing user data due to incompetence. The problem here is that self taught programmers are going out to the real world and writing code that gets used to process sensitive info without any senior developer guiding them or reviewing. If there was a penalty to the business, they would stop getting the bottom of the barrel programmer to work on their own. Yes it would make it a little harder to enter the market but any large business could still hire juniors and review their code properly. In most other industries, you are responsible for your work. Usually you even need a formal certification first.
- toastal 5y agoConceptually how is this different than someone building a staircase it their house with tools, lumber, and no interest in accessibility and building codes?
- SilverRed 5y agoThis analogy still works. The staircase is not public, its in your house. Which would map to running on your local computer or local network. As soon as you turn your house in to a public venue (put your code in use for the public) you now have to worry about accessibility and safety. If that stair case collapses because of your dodgy building, you are liable. But you are free to fall off your own staircase in your own house. So people are free to run whatever they want on their computer. But once you start taking user data, you now have legal responsibility. User data is hazardous waste that needs ultimate care.
- jart 5y agoThe worst thing about PHP is that the majority of people who visit my website are script kiddies from the third world pen testing for PHP vulnerabilities.
- mcintyre1994 5y agoI get this too. I doubt it's that active though at least in my case - I think hosting provider IP ranges are well known and bots just constantly throw known vulnerabilities in common web software at them to see what they can break into and backdoor.
- tored 5y agoGreat article. How should the community fix this problem with bad and dangerous tutorials? I don’t think fixing Google’s index is enough and probably not you something we can rely on.(there are other search engines) One problem could be that official PHP documentation only includes examples for using a specific function, not an entire use case from start to end. That would mean that examples would also include lots of HTML, CSS, SQL and JavaScript. But then of course it will no longer be a PHP documentation. Writing correct up to date examples is very time consuming. Sites like w3schools tries to do this, w3schools was bad in the past but has become better, but it is also a commercial site so nothing you don’t want to contribute to with your own examples. At the same time it is understandable that w3schools wants something in return. Another idea could be to contact site owners of these tutorials, but then they probably want the correct fix. This can also be time consuming. Maybe an index of approved tutorials voted by the community and then make sure this index gets high on Google ranking.
- CiPHPerCoder 5y ago> Great article. How should the community fix this problem with bad and dangerous tutorials? By updating all of the old, insecure tutorials to redirect towards secure answers instead. Details here: https://paragonie.com/blog/2018/01/our-ambitious-plan-make-insecure-php-software-thing-past https://paragonie.com/blog/2018/01/our-ambitious-plan-make-i...
- cletus 5y agoShould tutorials be expected to teach people sufficient security? Should code snippets be production-ready to put on the Internet for the general public? I tend to think not. Is this just me? So here's a partial list of issues you'd need to deal with: - sanitizing input - Escaping output - SQL injection - HTML injection - XSS - CSRF - CORS - Clickjacking - DDoS and other resource exhaustion attacks - Various timing attacks (eg password hashing) - How to store passwords - Depending on language, buffer overflows That's... a lot. You can take this even further: you should assume you're going to get compromised at some point. What are you going to do to detect a breach? Or an active attempt to find a breach? What's your strategy for handling a breach? Here's an analogy: we can tell you how to treat Poison Ivy without having to add a disclaimer that you're not qualified to be an attending dermatologist.
- crazygringo 5y agoYou're making the perfect into the enemy of the good. Should every tutorial be an entire 200-page course on all web security practices? Of course not. But should every tutorial that inserts a user-provided value into a SQL statement ensure it's escaped? Of course. There's essentially literally never a situation where you shouldn't do that. It's not just to be "production-ready" -- it's so basic as just to make sure the query will still even parse if the user includes a quote character in their input. So why on earth are you defending this mistake?
- rlayton2 5y agoI'd go further and say it's easier to teach prepared queries than string building (or at least equally difficult). That might not be true for other security issues but I think tutorial writers should be fine saying "here is a bit of magic that fixes a problem called csrf. We won't cover that in this course but leave this in here"
- tester34 5y ago>- sanitizing input Oh, that unicorn that everybody takes about, yet nobody does anything with it So, how do you sanitize input? you save in database escaped strings? allow only "english" letters? >- HTML injection >- XSS those two belong to >- Escaping output don't they? >- Various timing attacks (eg password hashing) >- How to store passwords just use state of art auth/login handling libs? >- DDoS and other resource exhaustion attacks I don't think I'd add it there, isn't it handled by firewall / infrastructure than app directly?
- treve 5y agoWhile the results are worrying, and not entirely surprising... the search query made me wonder how many different queries the author tried until getting a sufficiently bad result. I wonder if the more obvious 'PHP MySQL Tutorial' would also return this. I don't think that this changes the general point of the article, there is a _ton_ of bad information out there. I did the same with "Node.js JWT" and the results were even worse.
- jamil7 5y agoNode.js is more or less the new PHP so it makes sense.
- pshc 5y ago25 years of plentiful SQL injections and XSS, and 25 years of posters rushing to PHP’s defense with variants of “you could do this in any language. All languages are potentially insecure.” At a certain point it turns from tragedy to farce.
- cheeze 5y agoAmazon literally _banned_ php for a reason. Don't get me wrong, PHP taught me a ton about programming and was a very important language, but yeah...
- unobatbayar 5y agoW3Schools seems to be a great developers source while being quite reliable in terms of teaching best practices, avoiding exploits, and vulnerabilities.
- spicyramen 5y agoI worked with different teams at Google that build tutorials. The hard part of this is not creating them, but maintenance. Most of the teams move to a new product and there is no incentive in updating them, specially for security. Most of the updates have to do with versioning and compatibility for multiple components such as Db versions/GKE, SdK etc.
- villgax 5y agoCoPilot but for detecting horrible code & generating regexes.
- kilodeca 5y agoWhat should I say? Why those people think they need to write a tutorial? After all those "AI" GS can't figure out which one is good content and which one is trying to sell. Web has become a sad place. Where morons can have a voice and which are presented to others as good "content". Much of this would not continue to exist if there was no money to make.
- deleted 5y ago[deleted]
- mkl95 5y agoI'm not a fan of PHP, but I remember it having some lightweight, built in API to secure SQL queries. On the other hand, using a good ORM with a mature web framework removes most common vulnerabilities, and you don't have to worry as much about your junior peers creating security holes.
- hannob 5y agoPDO is pretty straightforward: $s = $dbc->prepare("SELECT * FROM table WHERE field = :foo"); $s->bindValue(':foo', $_GET['foo']); $r = $s->execute(); But all of that of course doesn't help if people don't use it.
- 1vuio0pswjnm7 5y agoHow do other search engine results compare in this regard.
- axelfreeman 5y agoI checked the first page of google results for "php sql login" in german and all examples are talking about escaping or prepared statements.
- technimad 5y agoI’ve fixed production bugs by removing code copied verbatim from the PHP manual. It looked like the clueless previous developer had copy pasted code from all over the place until the code sort of did what it was supposed to do. The code snippets by itself were ok, the composition created numerous bugs.
- matei88 5y agothis is the PHP bashing thread for this week, enoy ;-)
- jarym 5y agoI'm not surprised, plenty of tutorial writers (totally wrongly imo) want to write the simplest example they can cobble together under the guise of 'making it easy for people to understand'. There's no excuse for avoiding SQL escaping and using parameterised SQL and if it takes a bit longer for learners to pick it up then that's just the cost of learning something new. I really REALLY can't stand it.
- Cthulhu_ 5y agoThis already was a problem ten, fifteen years ago, and I see it hasn't changed. IIRC I wrote a blog post about it back when (I get spurts of inspiration, then some time later I delete the whole thing because I'm embarrassed about stuff I write, including HN comments). There was a big "grassroots" push some years ago about pusing W3Schools docs out of the top Google results in favor of MDN; the same should be done with bad PHP code / examples. Because in practice, 90% of code is copy / pasted and adjusted. There's just no big player behind PHP though, a party that wants to professionalize the language and more importantly its community. If there were, they would push for more authoritative tutorials and documentation. As it stands, the PHP docs are fine but are lacking information about SQL injection, and it's 10+ year old comments to that documentation that is often more valuable than the docs itself. PHP is still one of the top languages out there but it has so much more potential.
- ulzeraj 5y agoNot related to this specific case or coding but about bad practices in documentation in general in my previous job I had huge headaches with some bad practices described in Microsoft's Active Directory training material. That company forest domain ended in .local because the AD admin was a MS MVP through and through. https://en.wikipedia.org/wiki/.local#Microsoft_recommendations https://en.wikipedia.org/wiki/.local#Microsoft_recommendatio... However retail stores were almost entirely composed of Linux machines except for the manager's desktop. The corporate software used in these Linux machines would always pull samba which in turn pulled avahi. As soon as the software was installed post imaging because of licensing requirements connectivity with central servers was interrupted and the person installing it (which was always a different person because the stores were spread through the country) will often scratch their head, specially those who don't bother to read notes.
- thefr0g 5y agoI'm pretty sure that there is still quite some bad code out there that I posted to code-snippet websites when I was ~13 :/ So here's some advice I wish someone had given me back then: Please try to at least read and understand OWASP top ten security risks¹ before writing applications that anyone actually uses. Also please be aware that you can write insecure code in any general purpose language. Most of the bad PHP code is around because it was a popular language with hobbyists, similiar to Javascript and Python today. Languages might be better (or worse) in certain aspects but they still can't protect you from bugs in your programs logic. Only diligent planning, understanding of best practises and proper communication can help prevent those. ¹ https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/
- dusted 5y agoThis just in: "Search results are the result of searching"
- nazrulmum10 5y agoWe will create a signup system that allows users to create a new account to the system. Our first step is to create a HTML registration form. The form is pretty simple to create. It only asks for a name, email, password, and confirm password. Email addresses will be unique for every user. Multiple accounts for the same email address are not allowed.
- hooby 5y ago> You can't just blindly copy paste code from the internet and expect it to be perfectly safe and sound. What a surprise!
- omgitsabird 5y agoLet me show you how to do a mysql query for a web app in nodejs. const express = require('express'); const app = express(); const mysql = require('mysql'); app.get('/', (req, res) => { const connection = mysql.createConnection({ host: 'localhost', user: 'me', password: 'secret', database: 'my_db' }); connection.connect(); connection.query( `SELECT a FROM b WHERE x = ${req.query.y}`, (err, results) => { res.send(results[0]?.a); connection.end(); }); }); app.listen(1234); Now this will be a google result somewhere for how to do a query that contains an SQL injection vulnerability. I fail to see the point of this article, as pretty much anyone who enters into web programming understands that there is something called an SQL injection vulnerability that they need to be aware of.
- deleted 5y ago[deleted]
- bobmaxup 5y agoIs it just me or does every post on HN about PHP associated with some negative idea turn into an unmoderated flame war?
- bogwog 5y ago> associated with some negative idea I've never seen a post on this site about PHP that was associated with a positive idea.
- doomleika 5y agoIn my work, when I raised the design/code will expose serious security implications, Architects/seniors looked at me like I am a freak. Same person always bragged how important is security and how he/she is good at it. The management ate it. It's only when real money are lost and the C-Suit want heads to roll then maybe Mid-Low management will start take my words seriously...for a few months. There's just no easy way to verify the security of an app. Being security aware and try to make the code secure will cost extra time and make you a diva. Right now I simply refuse allow those madness infect my code and create clear paper trails, so I can keep my code/job rather sane in the asylum.
- oknowitsserious 5y agoThe first "correct" example uses the deprecated function mysql_real_escape_string. Are we still not considering every form of escaping insecure? https://www.php.net/manual/en/function.mysql-real-escape-string.php https://www.php.net/manual/en/function.mysql-real-escape-str...
- neycoda 5y agoGood job, you found how the real world works. I'm sure there's no code from any other language with vulnerabilities in it posted online.
- closeparen 5y agoI work on a major mobile application. We have rigorous interviews and pay well. We use a much trendier stack than PHP. Still, the number of my colleagues who can fathom that a request to our public API might come from elsewhere than our first-party client is… maybe one in a hundred. Don’t think this is just a PHP problem. All across the industry, people think of the OWASP Top 10 as some hyper-nerd shit that they don’t have to care about, and are indignant that you’d even mention it in design review.
- kevincox 5y agoGoogle has an internal "style guide" that forbids any new projects in PHP because they consider it impossible to write secure applications in this language. Of course the end result is probably they they have less PHP expertise than you might hope. But these are really sad failures.
- amachefe 5y agoGoogle is a search engine, not a code instructor.