Received: from localhost (unknown [200.46.204.183])
	by mail.postgresql.org (Postfix) with ESMTP id A644664FCBE
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Fri,  2 Jan 2009 16:11:50 -0400 (AST)
Received: from mail.postgresql.org ([200.46.204.86])
	by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024)
	with ESMTP id 09529-10 for
	<pgsql-admin-postgresql.org@mail.postgresql.org>;
	Fri,  2 Jan 2009 16:11:47 -0400 (AST)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from smtp112.iad.emailsrvr.com (smtp112.iad.emailsrvr.com
	[207.97.245.112])
	by mail.postgresql.org (Postfix) with ESMTP id 34C9264FC85
	for <pgsql-admin@postgresql.org>; Fri,  2 Jan 2009 16:11:47 -0400 (AST)
Received: from relay1.r1.iad.emailsrvr.com (localhost [127.0.0.1])
	by relay1.r1.iad.emailsrvr.com (SMTP Server) with ESMTP id D17CE44C067;
	Fri,  2 Jan 2009 15:11:45 -0500 (EST)
Received: by relay1.r1.iad.emailsrvr.com (Authenticated sender:
	chander-AT-otg-nc.com) with ESMTPSA id 7F69144C03E;
	Fri,  2 Jan 2009 15:11:45 -0500 (EST)
Message-ID: <495E7509.3090607@otg-nc.com>
Date: Fri, 02 Jan 2009 15:11:53 -0500
From: Chander Ganesan <chander@otg-nc.com>
User-Agent: Thunderbird 2.0.0.18 (Windows/20081105)
MIME-Version: 1.0
To: Marc Fromm <Marc.Fromm@wwu.edu>
CC: Scott Marlowe <scott.marlowe@gmail.com>,
	"pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: access data in php
References: 
 <B0D7C0A3F35FE144A70312D086CBCA9B0213E18F15@ExchMailbox2.univ.dir.wwu.edu>	
	<alpine.DEB.2.00.0901021900580.1850@xigix.ioguix.net>
	<dcc563d10901021028g3867def2p654d56099d177a5@mail.gmail.com>
	<B0D7C0A3F35FE144A70312D086CBCA9B0213E18FC1@ExchMailbox2.univ.dir.wwu.edu>
In-Reply-To: 
 <B0D7C0A3F35FE144A70312D086CBCA9B0213E18FC1@ExchMailbox2.univ.dir.wwu.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Archive-Number: 200901/7
X-Sequence-Number: 31054

Marc Fromm wrote:
> This is my code:
> <?php
> $dbconn = pg_connect("host=localhost port=5432 user=postgres dbname=studentalerts");
>
> if(isset($_GET["value"])){
> 	$w_number=$_GET["value"];
> }
> //echo $w_number;
>
> $query = "select first_name, last_name, alert from alert_list where w_number='$w_number'";
>   
You should probably be using code that looks like this:

$query = "select first_name, last_name, alert from alert_list where w_number='" . pg_escape_string($w_number) . "'"

Otherwise you're vulnerable to SQL Injection attacks..  For example, what happens if w_number looks like this:

' UNION ALL select usename, passwd, '1' from pg_shadow where 'a'='a

Granted, your user might not have sufficient privileges to view *that* information (of course, your app connects as postgres, so they probably would have access to that data), but there are lots of other nifty things that an attacker could gather to subvert your system.  One might be:

' UNION ALL select ccnumber, cid, addr1 from creditcards where 'a'='a


> $result = pg_query($dbconn,$query);
> if (!$result) {
>     echo "Problem with query " . $query . "<br/>";
>     echo pg_last_error();
>     exit();
> } 
>
> $rows = pg_fetch_assoc($result);
>   
This line ( $rows=pg_fetch_assoc($result);) should be:
$rows = pg_num_rows($result)

You just want to check that there were results, right?

Every time you call pg_fetch_assoc($result) the result set is advanced 
to the next row of results, so you shouldn't use this unless you want to 
actually process a row of results...

Generally speaking, you might have an easier time of interfacing with 
the database if you use an abstraction layer like ADODB 
(http://adodb.sf.net)

-- 
Chander Ganesan
Open Technology Group, Inc.
One Copley Parkway, Suite 210
Morrisville, NC  27560
919-463-0999/877-258-8987
http://www.otg-nc.com
Ask me about Expert PostgreSQL, PHP, Python, and other Open Source training!