Security Issue in my script

vividona

hi friends,

plz check my poor script

http://bhl.43i.net

admin account: aaa
admin pass : aaa

if you open any article like:

http://bhl.43i.net/index.php?Artid=16

if I put the sign of single quote ( ' ) after the article number in browse it give this message

http://bhl.43i.net/index.php?Artid=16%27

vividona

another issue

I used function nl2br() so that I can use new lines in articles. before when I click (enter) the text not show in new line.

but I noticed when I click in article title to read more about the article, the text show without new lines.

laserlight

You probably failed to use [man]mysql_real_escape_string/man to escape your string values before using them in your SQL statements.

vividona

plz check
this is a part of my class. It check for subject and text body

public function ClnArtiSub(){
		if( ! get_magic_quotes_gpc() ){
			return addslashes(htmlspecialchars( $this->ArtiSub ));
		}
	}

public function StripArtiSub() {
	if( ! get_magic_quotes_gpc() ) {
		return stripslashes(htmlspecialchars( $this->ArtiSub ));
	}
}

public function ClnArtiBod(){
	if( ! get_magic_quotes_gpc() ){
		return addslashes(htmlspecialchars( $this->ArtiBod ));
	}
}

public function StripArtiBod() {
	if( ! get_magic_quotes_gpc() ) {
		return stripslashes(htmlspecialchars( $this->ArtiBod ));
	}
}

vividona

is it necessary to use mysql_real_escape_string() in mysql queries also???

laserlight

Oh wait, I think I jumped to conclusions too quickly. Nonetheless, it did reveal that you used addslashes() instead of mysql_real_escape_string(), so you should switch. Other than that your code is fine.

vividona wrote:
if I put the sign of single quote ( ' ) after the article number in browse it give this message

How do you place the single quote? The urlencoding of ' to %27 is expected.

vividona

hi LaserLight,

I used addslashes() when I insert the text in database
and stripslashes() when I select the text from database

is that correct?

laserlight

vividona wrote:
I used addslashes() when I insert the text in database
and stripslashes() when I select the text from database

is that correct?

No, you should use mysql_real_escape_string() for insertion and do nothing (other than the appropriate escaping for output, e.g., htmlspecialchars()) for retrieval.