SQL Injection via url

Question

At the moment my site is as www.site.com.br/blablabla_id_2 for the definition of pages.

I use mysqli to do database searches with this id.

$id = $_GET['id'];

$result = mysqli_query($con,"SELECT * FROM post WHERE id_post = '$id'");

if(mysqli_num_rows($result) == 0){

    header("Location: 404.php");

}else{

    //Resto do código

}

I will have some problem with sql Injection?

Answer 1

Joining what I had already commented with Q&A pointed out by Marcio, follows a modification that solves the problem in the first two lines of code, saving an unnecessary application layer for the case in question:

mysqli_set_charset( 'utf8' );                   // pode usar 'latin1' ou 'ascii'
$id = mysqli_real_escape_string( $_GET['id'] ); // aqui estamos 100% sanitizados.

$result = mysqli_query($con,"SELECT * FROM post WHERE id_post = '$id'");
if(mysqli_num_rows($result) == 0){
    header("Location: 404.php");
}else{
    //Resto do código
}

Notes:

• The first line is extremely important to avoid a vulnerability that allows certain characters to escape sanitation. Setting the correct page, the interpretation of the escape works as expected.

• In the second line we do the sanitization itself.

• Important to note that although you are working with numerical data, I have not removed the quotes from your query purposely, as an extra protection. If you prefer, you can remove them, but forcing something in the sense of $id be even numerical (summed with zero, for example).

Answer 2

Your code is totally vulnerable to SQL Injection, to prevent intrusions you can use two very useful resources, the input filters and the PDO for your query to be parameterized.

Your code with the use of these resources becomes:

$id = filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT);

// Depois de criar o objeto PDO com o driver do seu banco de dados, utilize o código abaixo

$Ps = $Pdo->prepare('SELECT * FROM post WHERE id_post = :id');

$Ps->execute([':id', $id]);

if ($Ps->rowCount() == 0) {
    header('Location: 404.php');
    die();
} else {
    // Pelo menos um registro foi localizado
}

Answer 3

I would do as Rcio Simao proposed, using PDO, but if in your case it is complex change all the code from mysqli to PDO, follows below, an alternative:

    <?php 
    class DB{
        private $conn;

        public function getConnection(){
            $this->conn = new mysqli("localhost", "root", "", "mvc");
        }
        public function execReader($SQL){
            return $this->conn->query($SQL);
        }            
    }

    $id = filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT);
    $SQL = "SELECT * FROM produtos WHERE id = ".  addslashes($id);

    $DB = new DB();
    $DB->getConnection();
    $query = $DB->execReader($SQL);
    if ($query == 0) {
        header('Location: 404.php');
        exit();
    }

    $vo = new ProdutoVO();
    while($reg = $query->fetch_array(MYSQLI_ASSOC)){
        $vo->setId($reg["id"]);
        $vo->setNome($reg["nome"]);
        $vo->setMarca($reg["marca"]);
        $vo->setPreco($reg["preco"]);
    }

    var_dump($vo);
    ?>

Answer 4

Friend, to solve this problem and make your life easier regarding database queries among other various functions, try using "PHP PDO", an example that would solve your problem would be this:

prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':value', $value);

// insert one row
$name = 'one';
$value = 1;
$stmt->execute();

// insert another row with different values
$name = 'two';
$value = 2;
$stmt->execute();
?>

Take a look at the documentation of Prepared Statements PHP and in that of PDO