Home » Forums » PHP OpenBiz 2.X Forums » Release & Bugs Report

SQL INJECTION

Submitted by thomaz on Mon, 09/14/2009 - 14:49.

Hi

Today I have realized that OB 2.4 allows SQL Injections...how is it possible. What do you think is the best place to add a function like :

function escapeString($string) {
        /*
        * Use the appropriate escape string depending upon which version of php
        * you are running
        */
        if (version_compare(phpversion(), '4.3.0', '<')) {
            $string = mysql_escape_string($string);
        } else     {
            $string = mysql_real_escape_string($string);
        }

        return $string;
    }

And OB 2.4 allows HTML injections so if you fill an input field with  <script>alert('spam');</script> it will show up to other users when listing objects in grid or editing that object :)

Thomaz

‹ BizDataObj Format problem Problem searching dates ›
#1Submitted by mr_a_ton on Tue, 09/15/2009 - 02:00.

thanks for your solution i

thanks for your solution

i have some point for SQL Injection:

1. this isue is urgent
2. phpOpenBiz designed to support  any database type, and use Zend_Db as backend library
3. solution must for all database type too
4. the security code stored on database layer (BizDataObj)
 

based on the above criteria, in my opinion,
better to use the features of Zend_Db,
Zend_Db have quoteXXX and other method for this case fulfilled
 

ref:
http://wiki.ekini.net/main/Zend_db#Writing_Custom_SQL_Queries
http://www.phpframeworks.com/php-frameworks-news/index.php?id=1

 

Agus Suhartono | ThePhpEnterprise.Com
#2Submitted by rocky on Tue, 09/15/2009 - 16:14.

Can we conclude that - To

Can we conclude that

- To avoid SQL Injection, we can use Zend_DB quoteXXX method

- To avoid HTML injection (or XSS), we can htmlentities before return the content to browser
 
Thanks!
#3Submitted by jim on Tue, 09/15/2009 - 17:23.

So the SQL Injection would

So the SQL Injection would be averted somewhere in the BizDataObj code and the HTML injection at ClientProxy:GetFormInputs?

Also, I vote that we back port this bug fix to the 2.3 as well.

 
#4Submitted by thomaz on Tue, 09/15/2009 - 06:09.

Yes you are right, the

Yes you are right, the solution should not depend on DB type. It works fine after fixing the bug posted before :)

 

Thomaz
#5Submitted by support on Mon, 09/14/2009 - 17:54.

Many thanks to thomaz for

Many thanks to thomaz for pointing this out. We will definitely do more research and get it fixed soon.

- support
#6Submitted by thomaz on Mon, 09/14/2009 - 16:30.

Ok I guess  there is a

Ok I guess  there is a HUGE bug in that code: 
public function GetFormInputs ($ctrlName = null, $toString = TRUE)
    {
        if ($ctrlName) {
            if (isset($_REQUEST[$ctrlName])) {
                if (is_array($_REQUEST[$ctrlName]) and $toString == TRUE) {
                    $array_string = '';
                    foreach ($_REQUEST[$ctrlName] as $rec) {
                        $array_string .= $rec . ",";
                    }
                    $result = substr($array_string, 0, strlen($array_string) - 1);
                } else {
                    $result = $_REQUEST[$ctrlName];
                }
                if (get_magic_quotes_gpc() == 0)
                    $result = addslashes($result);
                return $result;
            } else {
                return null;
            }
        } else {
            return $_REQUEST;
        }
    }
 
[ OH god - missplaced reply again! :) ]
#7Submitted by jim on Mon, 09/14/2009 - 15:22.

I can confirm the

It might be best to apply a check like this in ClientProxy:GetFormInputs() which does addslashes.

     /**
     * ClientProxy::GetFormInputs() - get form all inputs or one input if ctrlName is given
     *
     * @param string $ctrlName
     * @param boolean $toString - Convert array oriented form controls to string
     * @return array or string
     */
    public function GetFormInputs ($ctrlName = null, $toString = TRUE)
    {
        if ($ctrlName) {
            if (isset($_REQUEST[$ctrlName])) {
                if (is_array($_REQUEST[$ctrlName]) and $toString == TRUE) {
                    $array_string = '';
                    foreach ($_REQUEST[$ctrlName] as $rec) {
                        $array_string .= $rec . ",";
                    }
                    $result = substr($array_string, 0, strlen($array_string) - 1);
                } else {
                    $result = $_REQUEST[$ctrlName];
                }
                if (get_magic_quotes_gpc() == 0)
                    addslashes($result);
                return $result;
            } else {
                return null;
            }
        } else {
            return $_REQUEST;
        }
    }