-1
\$\begingroup\$

Please verify security from SQL injection attacks.

homepage.php

<html>
<head>
</head>
<body>
<ul id="list">
            <li><h3><a href="search.php?name=women-top">tops</a></h3></li>
            <li><h3><a href="#">suits</a></h3></li>
            <li><h3><a href="#">jeans</a></h3></li>
            <li><h3><a href="search.php?name=women">more</a></h3></li>
            </ul>
</body>
</html>

second.php

<?php
$mysqli = new mysqli('localhost', 'root', '', 'shop');

   if(mysqli_connect_errno()) {
      echo "Connection Failed: " . mysqli_connect_errno();
      }
?>
<html>
<head>
</head>
<body>
<?php
session_start();
$lcSearchVal=$_GET['name'];
//echo "hi";
$lcSearcharr=explode("-",$lcSearchVal);
$result=count($lcSearchVal);
//echo $result;



$parts = array();
$parts1=array();
foreach( $lcSearcharr as $lcSearchWord ){
    $parts[] = '`PNAME` LIKE "%'.$lcSearchWord.'%"';
    $parts1[] = '`TAGS` LIKE "%'.$lcSearchWord.'%"';
    //$parts[] = '`CATEGORY` LIKE "%'.$lcSearchWord.'%"';
}
$stmt = $mysqli->prepare("SELECT * FROM xml where ('.implode ('AND',:name).')");
$stmt->bind_Param(':name',$parts);

$list=array();
if ($stmt->execute()) {
  while ($row = $stmt->fetch()) {
    $list[]=$row;
  }
}


    $stmt->close();

    $mysqli->close();
foreach($list as $array)
{
?>
            <div class="image">
<img src="<?php echo $array['IMAGEURL']?>" width="200px" height="200px"/></a>
<?php
}
?>
</div>
</body>
</html>

When I click on a link in homepage.php, it will search from XML for the products related to the clicked link. Please verify whether the SQL statement is secured from a Google bot's attack and whether it's handling the data securely or not.

\$\endgroup\$
  • \$\begingroup\$ Is $parts1 used at all ? \$\endgroup\$ – SylvainD Apr 23 '14 at 8:34
  • \$\begingroup\$ no sir.its not used till now.can delete $parts1. \$\endgroup\$ – user3545382 Apr 23 '14 at 8:35
  • \$\begingroup\$ @Josay-please help on this.i m not able to correct it. \$\endgroup\$ – user3545382 Apr 23 '14 at 9:08
2
\$\begingroup\$

You are not validating and not escaping $_GET['name'].

Although @wouter-j pointed out in a comment that the prepared statement should protect you, this post on Security SE argues otherwise, so I don't think you should count on it.

And I think you have some errors too. For example if this works, it looks like magic to me:

$stmt = $mysqli->prepare("SELECT * FROM xml where ('.implode ('AND',:name).')");
$stmt->bind_Param(':name',$parts);
\$\endgroup\$
  • \$\begingroup\$ no.its not working sir.Thats why i m looking for help.please correct my code.its giving me serious headache.@Janos \$\endgroup\$ – user3545382 Apr 23 '14 at 10:36
  • 4
    \$\begingroup\$ @user3545382 You might be better of asking stack overflow this question my friend \$\endgroup\$ – Niall Szalkai Apr 23 '14 at 10:45
  • \$\begingroup\$ Since he is using prepared statements, he doesn't have to escape $_GET['name'] anymore. \$\endgroup\$ – Wouter J Apr 23 '14 at 15:00
  • 1
    \$\begingroup\$ @WouterJ would you disagree with this post: security.stackexchange.com/questions/15214/… \$\endgroup\$ – janos Apr 23 '14 at 17:18
  • \$\begingroup\$ @janos - I for one would disagree with your linked post. All I read was a bunch of "if this" and "if that" then "maybe" something bad might happen. I'd be interested in reading anything that shows an actual exploit especially in the context of mysql and simple sql statements. Not trying to be hostile but I'd like to see some facts. \$\endgroup\$ – Cerad Apr 23 '14 at 21:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.