Mysql injection

Rory1

Hey,
I've got a with a form which injects data into a table in a mysql database. The table is called subscribe. When users submit their details in a form the details aren't written into the table, just a new row is created, without any infomation. The code for the form is

 <html>
<head>
<align><center><form action="subscribe.php">
<br>
<b><u>Clan Name:</u></b> 
 <input type="text" name="Clan">
<br>
<b><u>Contact Email:</u></b> 
<input type="text" name="email">
<br>
<b><u>Clan Members</b></u>
<br>
<textarea name="members"></textarea>
<br>
<b><u>Clans Website</b></u>
<br>
<input type="text" name="WEBSITE">
<br>
Please check these details are all correct, and then
<input type=submit value=Submit>
</form>
</html>
</head></center>

The second file 'subscribe.php' code is as follows,

<?
//MySQL Variables. Edit where necessary
$host = "localhost";
$login_name = "xxxxxx";
$password = "xxxxxxx";

//Connecting to MYSQL
MySQL_connect("$host","$login_name","$password");

//Select the database we want to use
MySQL_select_db("knockou_knockout") or die("Could not select database");
$Clan=$_POST["Clan"];
$email=$_POST["email"];
$members=$_POST["members"];
$WEBSITE=$_POST["WEBSITE"];

$sql=("INSERT INTO subscribe SET
Clan=\"$Clan\",
email=\"$email\",
members=\"$members\",
WEBSITE=\"$WEBSITE\"
");
$result= mysql_query($sql);
if ($result) {
echo("Thank you, your details have been taken");
}else{
echo("There was an error. Please contact Michael or Sacul");
}
//MySQL_close()
?>

I was talking to someone else and they were saying that I should should use VALUE instead of SET.

The table subscribe has 4 columns, Clan,email,members,website.

If anyone can tell me why the infomation from the form is not being sent to the database, I would really appriciate it.
🙂

barand

Specify method="post" for your form, otherwise it defaults to 'get'.
Your next page is picking up the $_POST variables which, at the moment, do not exist.

ahundiak

You don't use SET with an INSERT operation.

INSERT INTO subscribe VALUES($clan,$email,$members,$website);
http://www.mysql.com/doc/en/INSERT.html

barand

Always safer to specify the fields you are inserting the values into in case you add a filed to the database or change the order at a later date. Also quotes around text data.

INSERT INTO subscribe (clan,email,members,website)
VALUES('$clan','$email','$members','$website');

barand

Ahundiak

I know it isn't standard SQL but I just looked up INSERT in MySQL manual

6.4.3 INSERT Syntax
INSERT [LOW_PRIORITY | DELAYED] [IGNORE]
[INTO] tbl_name [(col_name,...)]
VALUES (expression,...),(...),...
or INSERT [LOW_PRIORITY | DELAYED] [IGNORE]
[INTO] tbl_name [(col_name,...)]
SELECT ...
or INSERT [LOW_PRIORITY | DELAYED] [IGNORE]
[INTO] tbl_name
SET col_name=expression, col_name=expression, ...

ahundiak

Barand,
By golly you are right. And I just checked the site before posting the advice not to use SET. Must be a reading impediment.
Thanks

Rory1

Thx for all the quick replies. I changed it so in the first file the third line is

<align><center><form action="subscribe.php" method=post>

I've also edited the following lines

$sql=("INSERT INTO subscribe SET 
Clan=\"$Clan\", 
email=\"$email\", 
members=\"$members\", 
WEBSITE=\"$WEBSITE\" 
");

to what barand said

$sql=INSERT INTO subscribe (clan,email,members,website) 
VALUES('$clan','$email','$members','$website');

I'm now getting an error on line 17, which is the line INSERT INTO subscribe. It says unexpected t_string 🙁 . Doh. What now?🙂

ahundiak

Missing some double quotes.

$sql="INSERT INTO subscribe (clan,email,members,website) 
VALUES('$clan','$email','$members','$website')";

Rory1

Thx! Was just trying some stuf out and I noticed that too.🙂

Rory1

You can add a resolved now.🙂 Thx for all the people who helped.

barand

Originally posted by Rory1
You can add a resolved now

Only you can do that, Rory

Norman_Graham

Btw Rory, just for your information, 'SQL injection' is a term referring to the use of rogue SQL queries in a form for the purpose of screwing up a database and/or illegitimately extracting database parameters for the purposes of screwing up the database. There are various methods to prevent it. The title of your thread made me think that was what your question was about - thought you might want to know that for the future.

Best o luck

Norm

Rory1

LOL, I think I've been reading too much security focus😉