[RESOLVED] Pagination & mysql injection - Quick Question

Scriptmaker

I followed the tutorial for pagination here:
http://www.evolt.org/node/19340

I understand how it all works, and I was able to implement it.

However, I run a function I found on php.net that uses mysql_real_escape_string on all the keys of the $POST and $GET arrays. This pagination tutorial and all of the others I've seen have you pass the $query that you generated with your script back to the same page as a $query variable in the url.

I can't figure out how to go about securing the data this way. If I run mysql_real_escape_string on $_GET['query'], I get a database error because now I have slashes where I shouldn't. If I don't use it, however, I'm just opening up a backdoor to my db, am I not?

Does anyone know any good articles on pagination security? I don't want to have to rebuild the query since there are 25+ possible variables that could be in the query and that would be a pretty long url.

Thanks!

NogDog

Your host's PHP configuration may have "magic quotes" turned on, which automatically adds back-slashes to escape certain characters from POST and GET inputs. I typically use a "sanitize" function something like the following, so that it will work regardless of the magic quotes setting:

function sanitize($value)
{
   if(get_magic_quotes_gpc())  // if magic quotes are on, get rid of escapes
   {
      $value = stripslashes($value);
   }
   return(mysql_real_escape_string($value));
}

Also, if a specific value should be an integer or a floating point number, you can force it into one by type-casting it, which will instantly "sanitize it":

$pagenum = (int)$_GET['pagenum'];
$price = round((float)$_GET['price'], 2);

Scriptmaker

But is it safe to pass an actual query through a url and then use it with $_GET['query'].

If the query is
"location='some place' AND id=someid"

And you escaped the quotes, you wouldn't be able to rerun the query without stripping slashes. How do you know someone didn't just pass their own ?query="1=1 malicious code" through?

bradgrafelman

Scriptmaker wrote:
But is it safe to pass an actual query through a url

In my opinion, no - not at all. If you're passing something that isn't a simple string/integer value but actually part of the SQL statement, you've got two problems:

You're really going to have to be careful about sanitizing the data and ONLY executing the type of data you inted to.
Your DB/query design is poor and you need to re-think one or the other (or both).

Scriptmaker

Thanks Brad.

I ended up just making a seperate "query string builder" for the GET data on subsequent results pages. The problem I have with this is that the filesize is now pretty much doubled (however, only the stuff under isset($GET['page'] will execute, so load time should be about the same)

I was trying to think of ways around this, and could only think of one:
If $POST['submit'] isset, put all of the $POST data into a variable, say, $COPY
If $GET['page'] isset, put all of the $GET data into $COPY instead

Then all of the subsequent code should use $COPY['whatever'] variables instead of $_POST['whatever']

I suppose from reading different opinions that this is generally a good practice anyway. Had I set it up like this to begin with I'd be saving myself a lot of headaches right now.

Thanks again everyone,
Jorge