SitePoint Sponsor

User Tag List

Results 1 to 5 of 5
  1. #1
    SitePoint Zealot
    Join Date
    Feb 2006
    Location
    East Yorkshire, UK
    Posts
    101
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Is this secure against injection

    hello fellow sitepointers,

    Right i am current re-programing one of my sites as it has being hacked and there was lots of stuff entered into the database that should not be there.

    Anyway here is my code for the registration section of the site, is this secure code ???

    PHP Code:
    // Empty all the required variables

        
    $username '';
        
    $account_type '';
        
    $password '';
        
    $password2 '';
        
    $email '';
        
    $email2 '';
        
    if(isset(
    $_POST['username']) && $_POST['username']!="")
        
    $username $_POST['username'];
        
    if(isset(
    $_POST['password']) && $_POST['password']!="")
        
    $password $_POST['password'];
        
    if(isset(
    $_POST['password2']) && $_POST['password2']!="")
        
    $password2 $_POST['password2'];
        
    if(isset(
    $_POST['email']) && $_POST['email']!="")
        
    $email $_POST['email'];
        
    if(isset(
    $_POST['email2']) && $_POST['email2']!="")
        
    $email2 $_POST['email2'];
        
    if(isset(
    $_POST['account_type']) && $_POST['account_type']!="")
        
    $account_type $_POST['account_type'];
        
        
    $username mysql_real_escape_string$username );
        
    $password mysql_real_escape_string$password );
        
    $password2 mysql_real_escape_string$password2 );
        
    $account_type mysql_real_escape_string$account_type );
        
    // Check the email address against the database to see if they have registered befor.

    $email_check mysql_query("SELECT * FROM users WHERE `email`='$email'");

    if((
    $num mysql_num_rows($email_check)) >1){

    errorHandling('Registration Error : More than one of the same email already exsists, Please go back and enter a new one');

    }elseif(
    $num == 1){

    errorHandling('Registration Error : This email address already exsists, Please go back and enter a new one');

    }else{

    // Do Nothing, There email address is not in the Database.

    }

    // Check the username against the database to see if they have registered befor.

    $username_check mysql_query("SELECT * FROM users WHERE `username`='$username'");

    if((
    $num mysql_num_rows($username_check)) >1){

    errorHandling('Registration Error : More than one of the same username already exsists, Please go back and enter a new one');

    }elseif(
    $num == 1){

    errorHandling('Registration Error : This username already exsists, Please go back and enter a new one');

    }else{

    // Do Nothing, There username is not in the Database.

    }

    // Check the two email addresses to see if they match.

    $email_double_check = if(($email == $email2) && ($email2 == $email)) {

    // No errors, the email addresses match.

    }else{

    errorHandling('Registration Error : The two email addresses did not match, Please go back and correct them.');

    }

    // Check the two passwords to see if they match.

    $password_double_check = if(($password == $password2) && ($password2 == $password)) {

    // No errors, the passwords match.

    }else{

    errorHandling('Registration Error : The two passwords did not match, Please go back and correct them.');

    }

    // Validate email addresses and check there in the correct format.

    $validate validate_email($email);

    if(
    $validate == NULL){

    errorHandling('Registration Error : The email address you entered does not validate.');

    }else{

    // Do Nothing, There email address validated.

    }

    $validate validate_email($email2);

    if(
    $validate == NULL){

    errorHandling('Registration Error : The second email you entered does not validate.');

    }else{

    // Do Nothing, There second email address validated.

    }

    // Time to make a random code for account activation.

    $unique_code makeUniqueCode();
    $unique_code_db md5($unique_code); 
    Kind Regards
    Chris
    I don't have an adictive personality! ,I just can't say no is all

  2. #2
    SitePoint Wizard
    Join Date
    Mar 2001
    Posts
    3,537
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    PHP Code:
    $username '';
    $account_type '';
    $password '';
    $password2 '';
    $email '';
    $email2 ''
    As far as I can tell, those lines are completely unnecessary. When you assign a value to a variable, it overwrites what was previously stored in the variable, e.g.
    PHP Code:
    $username $_POST['username']; 
    ------

    PHP Code:
    if(($num mysql_num_rows($email_check)) >1){

    errorHandling('Registration Error : More than one of the same email already exsists, Please go back and enter a new one');

    }elseif(
    $num == 1){

    errorHandling('Registration Error : This email address already exsists, Please go back and enter a new one'); 
    You can combine those into one if statement using: >= 1
    PHP Code:
    }else{

    // Do Nothing, There email address is not in the Database.


    Then delete the else branch if you aren't going to do anything.

    Apply all the above here as well:
    PHP Code:
    if(($num mysql_num_rows($username_check)) >1){

    errorHandling('Registration Error : More than one of the same username already exsists, Please go back and enter a new one');

    }elseif(
    $num == 1){

    errorHandling('Registration Error : This username already exsists, Please go back and enter a new one');

    }else{

    // Do Nothing, There username is not in the Database.



  3. #3
    SitePoint Zealot
    Join Date
    Feb 2006
    Location
    East Yorkshire, UK
    Posts
    101
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    ok, thanks for that ... apart from that will the script be secure against injection attacks
    I don't have an adictive personality! ,I just can't say no is all

  4. #4
    SitePoint Wizard
    Join Date
    Mar 2001
    Posts
    3,537
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

  5. #5
    Non-Member Icheb's Avatar
    Join Date
    Mar 2003
    Location
    Germany
    Posts
    1,474
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by bainsy
    // Empty all the required variables

    $username = '';
    $account_type = '';
    $password = '';
    $password2 = '';
    $email = '';
    $email2 = '';

    if(isset($_POST['username']) && $_POST['username']!="")
    $username = $_POST['username'];

    if(isset($_POST['password']) && $_POST['password']!="")
    $password = $_POST['password'];

    if(isset($_POST['password2']) && $_POST['password2']!="")
    $password2 = $_POST['password2'];

    if(isset($_POST['email']) && $_POST['email']!="")
    $email = $_POST['email'];

    if(isset($_POST['email2']) && $_POST['email2']!="")
    $email2 = $_POST['email2'];

    if(isset($_POST['account_type']) && $_POST['account_type']!="")
    $account_type = $_POST['account_type'];

    $username = mysql_real_escape_string( $username );
    $password = mysql_real_escape_string( $password );
    $password2 = mysql_real_escape_string( $password2 );
    $account_type = mysql_real_escape_string( $account_type );

    // Check the email address against the database to see if they have registered befor.

    $email_check = mysql_query("SELECT * FROM users WHERE `email`='$email'");
    I guess there's no end to making code unnecessarily complex.
    You just check whether those variables are set and then use
    mysql_real_escape_string($_POST['variable']) when you actually put them in a query.

    And btw, it's exists, not exsists. And there != their != they are.


Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •