security

[slimjim]

Cna anyone help me out here. I have this form below, and I want to stop everyone from hacking the server but also from doing anything they shouldn't thur use of the form. I got this far, but not sure how to safe gaurd anything.

<?PHP
require "/triala/conf.php";

if($submit == "Submit"){

$today = date("Y-m-d"); 	

	$query="insert into trial (id, fname, lname, address, mdate) values ('$id', '$fname', '$lname', '$address','$today')";

mysql_query($query) or die( "ERROR: " . mysql_error() . "\n");		
}
?>
<form action="add.php" method="post">
<div align="center">
<table>
<tr><td>
    <p align="right">First Name <input type="text" name="fname" size="20" value=""></p>
  </td></tr>
<tr><td>
    <p align="right">Last Name <input type="text" name="lname" size="20" value=""></p>
  </td></tr>
<tr><td>
    <p align="right">Street Address <input type="text" name="address" size="20" value=""></p>
  </td></tr>
<center>
<tr><td>
    <p align="center"><input type=submit name="submit" value="Submit"></p>
  </td></tr>
</table>
  </center>
</div>
</form>

[jannoy]

// if($submit == "Submit"){ // instead of using this one

if (isset($_POST['Submit'])) { //use this if your button has been clicked

$today = date("Y-m-d");

    $query="insert into trial (id, fname, lname, address, mdate) values ('$id', '$fname', '$lname', '$address','$today')"; 

mysql_query($query) or die( "ERROR: " . mysql_error() . "\n");         

}
// else if no button has clicked
{ echo "no clicked";
}

?>

[slimjim]

What would make that a secure form ? I have read so much about preventing certain chars and stipping of slashes. Dont understand to much about it. But what you mentioned doesnt make any sence to me either.

[gardnc]

I think what you are refering to is hacking a database throug sql insertion where no check is made of the inputed data to see if the sql server could mis-intrepret the data and provide information that it shouldn't.

This is a topic with lots of things that need to be address and is very important security. Best solution is to have a class that will examine each form item for sql insertions and reject the bad ones.

You need to google on sql insertion and maybe php sql insertion to find some pre-written classes you can use.

Larry

[slimjim]

Yes and I can't find anything, do you know of any pre-written clases url's to one of them ?
I been looking all day.

[gardnc]

try http://www.phpclasses.org

Larry

[slimjim]

What preg replace that would replace anything other then letters and numbers ? would that work and if so How would i do it for a whole form without doing it sperately for each input. Is there a sample that I can use for it also anywhere online or can someone give me a sample.

[gardnc]

This is not the kind of thing that casual readers of the forum are going to be happy giving you solutions for. I don't want to be responsible for mistakes that cost somebody data.

If the data in your data bases is trivial, don't worry about it. If a simple subroutine that assures the you will only have letters or numbers in sql queries then that is better than nothing.

What I've been trying to point out is that sql-insertion is not trivial and has no simplistic answer.

Larry