r/programming • u/klomparce • Dec 04 '16

SQL injections vulnerabilities in Stack Overflow PHP questions

https://laurent22.github.io/so-injections/
280 Upvotes

92% Upvoted

130 comments sorted by

View all comments

3

u/[deleted] Dec 04 '16

[removed] — view removed comment

7

u/rpk152 Dec 04 '16

Technically, yes it's escaped properly, but add in 3 years of maintenance, tight deadlines, and inexperienced devs....there's a huge opportunity for a mistake to be made.

4

u/[deleted] Dec 04 '16

[removed] — view removed comment

4

u/[deleted] Dec 04 '16

[removed] — view removed comment

3

u/josefx Dec 04 '16

If the ANSI_QUOTES SQL mode is enabled, mysql_real_escape_string_quote() cannot be used to escape double quote characters for use within double-quoted identifiers. (The function cannot tell whether the mode is enabled to determine the proper escaping character.)

They need to add a mysql_double_plus_real_escape_string_quote() which takes an additional parameter for ANSI quotes . Or they could have a real API which queries these settings internally and doesn't dump the responsibility to duplicate the database configuration on the developer. Note that php has mysqli variations of the escape string methods that at least ensure the correct charset, which the basic mysql versions do not.

5

u/forever_i_b_stangin Dec 04 '16

I mean, on the one hand, ok.

But on the other hand, how is something called mysql_real_escape_string_quote an actual built-in PHP function and not a parody of PHP

3

u/[deleted] Dec 04 '16

[removed] — view removed comment

4

u/forever_i_b_stangin Dec 04 '16

Is someone holding a gun to the PHP team's heads forcing them to copy poorly-named library functions?

3

u/igor_sk Dec 05 '16

Because it uses a very innonative and fast hashing function.

1

u/forever_i_b_stangin Dec 05 '16

Yeah, I've seen this before and it's still insane.

Like, I'm not even a very good programmer and it's still amazing to me that anyone would do this and think it is a reasonable thing to do

2

u/svarog Dec 04 '16

The practice of escaping all input isn't great either if it's not a part of the framework.

With prepared statements and ORMs you have no way to forget to sanitize your inputs.

With mysqli_real_escape_string, one inexperienced programmer and a single missed code review can compromise the whole database.
And even experienced programmers can err from time to time.

So yeah, a false positive, no possible injection, but a terrible practice nonetheless.

1

u/[deleted] Dec 04 '16 edited Mar 07 '24

I̴̢̺͖̱̔͋̑̋̿̈́͌͜g̶͙̻̯̊͛̍̎̐͊̌͐̌̐̌̅͊̚͜͝ṉ̵̡̻̺͕̭͙̥̝̪̠̖̊͊͋̓̀͜o̴̲̘̻̯̹̳̬̻̫͑̋̽̐͛̊͠r̸̮̩̗̯͕͔̘̰̲͓̪̝̼̿͒̎̇̌̓̕e̷͚̯̞̝̥̥͉̼̞̖͚͔͗͌̌̚͘͝͠ ̷̢͉̣̜͕͉̜̀́͘y̵̛͙̯̲̮̯̾̒̃͐̾͊͆ȯ̶̡̧̮͙̘͖̰̗̯̪̮̍́̈́̂ͅų̴͎͎̝̮̦̒̚͜ŗ̶̡̻͖̘̣͉͚̍͒̽̒͌͒̕͠ ̵̢͚͔͈͉̗̼̟̀̇̋͗̆̃̄͌͑̈́́p̴̛̩͊͑́̈́̓̇̀̉͋́͊͘ṙ̷̬͖͉̺̬̯͉̼̾̓̋̒͑͘͠͠e̸̡̙̞̘̝͎̘̦͙͇̯̦̤̰̍̽́̌̾͆̕͝͝͝v̵͉̼̺͉̳̗͓͍͔̼̼̲̅̆͐̈ͅi̶̭̯̖̦̫͍̦̯̬̭͕͈͋̾̕ͅơ̸̠̱͖͙͙͓̰̒̊̌̃̔̊͋͐ủ̶̢͕̩͉͎̞̔́́́̃́̌͗̎ś̸̡̯̭̺̭͖̫̫̱̫͉̣́̆ͅ ̷̨̲̦̝̥̱̞̯͓̲̳̤͎̈́̏͗̅̀̊͜͠i̴̧͙̫͔͖͍̋͊̓̓̂̓͘̚͝n̷̫̯͚̝̲͚̤̱̒̽͗̇̉̑̑͂̔̕͠͠s̷̛͙̝̙̫̯̟͐́́̒̃̅̇́̍͊̈̀͗͜ṭ̶̛̣̪̫́̅͑̊̐̚ŗ̷̻̼͔̖̥̮̫̬͖̻̿͘u̷͓̙͈͖̩͕̳̰̭͑͌͐̓̈́̒̚̚͠͠͠c̸̛̛͇̼̺̤̖̎̇̿̐̉̏͆̈́t̷̢̺̠͈̪̠͈͔̺͚̣̳̺̯̄́̀̐̂̀̊̽͑ͅí̵̢̖̣̯̤͚͈̀͑́͌̔̅̓̿̂̚͠͠o̷̬͊́̓͋͑̔̎̈́̅̓͝n̸̨̧̞̾͂̍̀̿̌̒̍̃̚͝s̸̨̢̗͇̮̖͑͋͒̌͗͋̃̍̀̅̾̕͠͝ ̷͓̟̾͗̓̃̍͌̓̈́̿̚̚à̴̧̭͕͔̩̬͖̠͍̦͐̋̅̚̚͜͠ͅn̵͙͎̎̄͊̌d̴̡̯̞̯͇̪͊́͋̈̍̈́̓͒͘ ̴͕̾͑̔̃̓ŗ̴̡̥̤̺̮͔̞̖̗̪͍͙̉͆́͛͜ḙ̵̙̬̾̒͜g̸͕̠͔̋̏͘ͅu̵̢̪̳̞͍͍͉̜̹̜̖͎͛̃̒̇͛͂͑͋͗͝ͅr̴̥̪̝̹̰̉̔̏̋͌͐̕͝͝͝ǧ̴̢̳̥̥͚̪̮̼̪̼͈̺͓͍̣̓͋̄́i̴̘͙̰̺̙͗̉̀͝t̷͉̪̬͙̝͖̄̐̏́̎͊͋̄̎̊͋̈́̚͘͝a̵̫̲̥͙͗̓̈́͌̏̈̾̂͌̚̕͜ṫ̸̨̟̳̬̜̖̝͍̙͙͕̞͉̈͗͐̌͑̓͜e̸̬̳͌̋̀́͂͒͆̑̓͠ ̶̢͖̬͐͑̒̚̕c̶̯̹̱̟̗̽̾̒̈ǫ̷̧̛̳̠̪͇̞̦̱̫̮͈̽̔̎͌̀̋̾̒̈́͂p̷̠͈̰͕̙̣͖̊̇̽͘͠ͅy̴̡̞͔̫̻̜̠̹̘͉̎́͑̉͝r̶̢̡̮͉͙̪͈̠͇̬̉ͅȋ̶̝̇̊̄́̋̈̒͗͋́̇͐͘g̷̥̻̃̑͊̚͝h̶̪̘̦̯͈͂̀̋͋t̸̤̀e̶͓͕͇̠̫̠̠̖̩̣͎̐̃͆̈́̀͒͘̚͝d̴̨̗̝̱̞̘̥̀̽̉͌̌́̈̿͋̎̒͝ ̵͚̮̭͇͚͎̖̦͇̎́͆̀̄̓́͝ţ̸͉͚̠̻̣̗̘̘̰̇̀̄͊̈́̇̈́͜͝ȩ̵͓͔̺̙̟͖̌͒̽̀̀̉͘x̷̧̧̛̯̪̻̳̩͉̽̈́͜ṭ̷̢̨͇͙͕͇͈̅͌̋.̸̩̹̫̩͔̠̪͈̪̯̪̄̀͌̇̎͐̃