I have written a simple PHP Script that takes $_POST
input and uses it to add data to a .json
file. Given the security flaws in my last post, I wanted to post this just to make sure. I can't see anyway for someone to attack my server using this program (especially because this is a script for an internal website), but you guys have often proven me wrong in claims like this. So if you see ANY security flaws, please point them out.
<?php
require "helper.php";
$dest = "../forms/additem.php";
if(!$sql) {
send(array("msg" => "ERROR: Cannot Connect to Database"));
}
if(!$_POST || !isset($_POST["handout"]) || !isset($_POST["quantity"]) || !isset($_POST["item"])) {
send(array("msg" => "ERROR: Did not receive Data"));
}
$hid = $_POST["handout"];
$quan = $_POST["quantity"];
$item = $_POST["item"];
$json = jread("../data.json");
if(!$json) {
send(array("msg" => "ERROR: Cannot read JSON File"));
}
foreach($json as $key => $property) {
if($key == $hid) {
$json[$key][0] = $item;
$json[$key][1] = $quan;
jwrite("../data.json", $json);
send($dest, array("msg" => "SUCCESS: Your Item has been Added!"));
}
}
send($dest, array("msg" => "ERROR: Either Handout doesn't exist, or item doesn't exist"));
?>
foreach
instead of just getting the array element you want directly? Looking at this, I see many other potential problems but since I don't know where some of your functions come from, I can't be sure. Note that input validation and sanitizing is always important. \$\endgroup\$