From: Chander Ganesan <chander@otg-nc.com>
To: Marc Fromm <Marc.Fromm@wwu.edu>
Cc: Scott Marlowe <scott.marlowe@gmail.com>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: access data in php
Date: Fri, 02 Jan 2009 15:11:53 -0500
Message-ID: <495E7509.3090607@otg-nc.com> (raw)
In-Reply-To: <B0D7C0A3F35FE144A70312D086CBCA9B0213E18FC1@ExchMailbox2.univ.dir.wwu.edu>
References: <B0D7C0A3F35FE144A70312D086CBCA9B0213E18F15@ExchMailbox2.univ.dir.wwu.edu>
<alpine.DEB.2.00.0901021900580.1850@xigix.ioguix.net>
<dcc563d10901021028g3867def2p654d56099d177a5@mail.gmail.com>
<B0D7C0A3F35FE144A70312D086CBCA9B0213E18FC1@ExchMailbox2.univ.dir.wwu.edu>
Marc Fromm wrote:
> This is my code:
> <?php
> $dbconn = pg_connect("host=localhost port=5432 user=postgres dbname=studentalerts");
>
> if(isset($_GET["value"])){
> $w_number=$_GET["value"];
> }
> //echo $w_number;
>
> $query = "select first_name, last_name, alert from alert_list where w_number='$w_number'";
>
You should probably be using code that looks like this:
$query = "select first_name, last_name, alert from alert_list where w_number='" . pg_escape_string($w_number) . "'"
Otherwise you're vulnerable to SQL Injection attacks.. For example, what happens if w_number looks like this:
' UNION ALL select usename, passwd, '1' from pg_shadow where 'a'='a
Granted, your user might not have sufficient privileges to view *that* information (of course, your app connects as postgres, so they probably would have access to that data), but there are lots of other nifty things that an attacker could gather to subvert your system. One might be:
' UNION ALL select ccnumber, cid, addr1 from creditcards where 'a'='a
> $result = pg_query($dbconn,$query);
> if (!$result) {
> echo "Problem with query " . $query . "<br/>";
> echo pg_last_error();
> exit();
> }
>
> $rows = pg_fetch_assoc($result);
>
This line ( $rows=pg_fetch_assoc($result);) should be:
$rows = pg_num_rows($result)
You just want to check that there were results, right?
Every time you call pg_fetch_assoc($result) the result set is advanced
to the next row of results, so you shouldn't use this unless you want to
actually process a row of results...
Generally speaking, you might have an easier time of interfacing with
the database if you use an abstraction layer like ADODB
(http://adodb.sf.net)
--
Chander Ganesan
Open Technology Group, Inc.
One Copley Parkway, Suite 210
Morrisville, NC 27560
919-463-0999/877-258-8987
http://www.otg-nc.com
Ask me about Expert PostgreSQL, PHP, Python, and other Open Source training!
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: chander@otg-nc.com, Marc.Fromm@wwu.edu, scott.marlowe@gmail.com
Subject: Re: access data in php
In-Reply-To: <495E7509.3090607@otg-nc.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox