18
votes
Accepted
Preventing SQL injection by converting all characters to their ASCII values
There's a common credo believed when evaluating the security of software:
If it's homemade, it's unlikely secure.
Sec.SE has a Q&A about homemade algorithms, which is somewhat germane to your ...
- 5,717
16
votes
Accepted
Inserting OAuth data into a database
I don't know that my code is vulnerable to SQL injection.
Yes, it is.
You should never put any variables directly into SQL statements. Even if you think that the variables may possibly be safe, it'...
- 25k
12
votes
Secured registration script
Correctness
Also, all of the code works.
No, it doesn't, so let's start with that.
...
- 24k
10
votes
Accepted
A Simple, One-Page PHP Admin Login (with prepared SQL statements)
Security
I'm not all that comfortable with echoing unsanitized user input: echo '<form action=' . $_SERVER['REQUEST_URI'] . ' method = "post">';. I did not ...
- 25k
8
votes
Function to get rows from database
Your code will work, of course, but you go to a lot of trouble to grind the result set into an array when that capability is already available. Mysqli would provide the ...
- 283
8
votes
Accepted
PHP MySQLi Connection File
First of all, there are many things in this code which you did right. Setting the proper error reporting mode is brilliant! And always setting the port explicitly is also a very good thing, saving you ...
- 7,956
7
votes
A PHP User System
- How may I make it more flexible?
Depend on abstractions not on concretions (SOLI D )
__construct(Request $request, Response $response, Mapper $mapper)
Each ...
- 246
7
votes
Preventing SQL injection by converting all characters to their ASCII values
Is this method safe?
Well, assuming ord is safe, it should be safe, because you will only ever have strings containing numbers in your query.
But what is also ...
- 25k
7
votes
Inserting a record into MySQL with a timestamp
Security
SQL Injection
It's probably[*] secure, but it's not the right way to do it, see for example here why prepared statements are better than escaping. Sooner or later, you will mess up when ...
- 25k
7
votes
Secured registration script
Your code is secure but hard to read, unclear and inconsistent. Poor Scarlett O'Hara will be saved in the database as ...
- 7,956
7
votes
Accepted
PHP santization of textarea input
No, don't do that. You seem to be filtering and escaping values out of paranoia rather than understanding what exactly would lead to a vulnerability. As a result, you are corrupting your data.
A well ...
- 143k
7
votes
Accepted
Return row count from mysqli prepared statement
You should definitely not be mixing procedural and object-oriented syntax.
Although it works with un-mixed syntax, the process is working harder than it needs to and delivering more result set data ...
- 8,334
7
votes
Accepted
Query builder class pdo,sql
You have turned simple SQL prepared statements into this monstrosity that is extremely difficult to read and is open to SQL injection. Remove it! Don't go down this path. It is absolutely unnecessary.
...
- 881
6
votes
A Simple, One-Page PHP Admin Login (with prepared SQL statements)
I agree with tim.
The data is stored without analysis the content:
$_SESSION['a_user'] = $_POST['a_user'];
I recommend two treatments: One for database (...
6
votes
Accepted
Basic registration page and database insertion
Security
SQL Injection
Never put any variable data directly into SQL queries (the type of query doesn't matter, all can be vulnerable to SQL injection). This allows attackers to execute SQL queries ...
- 25k
6
votes
Accepted
Function to get rows from database
The answer by Darwin von Corax would be better, but doesnt help you understand why your current code is wrong:
You use fetch_array() with the ...
- 762
6
votes
Accepted
Adding tables and values to a database
Security
First of all, you should require that install scripts are deleted after installation, as they are no longer needed.
But since some users will just rename the install directory instead of ...
- 25k
6
votes
Accepted
Database and user classes for my personal CMS
Security
SQL Injection
You are completely open to SQL injection.
It is not enough to simply use prepare. The important part is that you should never put ...
- 25k
6
votes
Adding an item to database + JSON
You have a major security vulnerability.
As in, serious enough that if I knew your web address, I could delete your entire database.
Near the top of your code, you set ...
- 429
6
votes
Accepted
Adding an item to database + JSON
SQL Injection
To expand a bit about what @Åna said: Yes, you are open to SQL injection. mysqli_query doesn't actually support multi-queries, so the described ...
- 25k
6
votes
Security of post submission, picture upload and post fetch
Please read about sql injection. Basically you should be using prepared statements with parameters for executing SQL queries - either PDO::prepare() or ...
- 26.4k
6
votes
OOP: The correct use of classes and optimizing code
1. This is not OOP
Ask yourself one simple question: what would happen if you remove words "class", "DBX" and "static" from your code?
Nothing.
Nothing would happen. It ...
- 7,956
5
votes
Accepted
A PHP User System
Misc
password_verify returns a boolean value, so there is no need to do == true, just ask ...
- 25k
5
votes
A very secure procedural MySQLI login script against injections
You're not checking whether $_POST[..] exists at all or whether any data has been submitted via POST, this may cause ...
- 320
5
votes
Accepted
Password recovery program
Security practices and correctness
It's probably a good idea to keep an audit log of the times and client IP addresses for all attempted and completed password changes.
...
- 143k
5
votes
Inserting JSON array data into a MySQL database using PHP
You are open to SQL Injection. To prevent this, use prepared statements.
You also should not mix mysql_ and mysqli_ functions; ...
- 25k
5
votes
Inserting JSON array data into a MySQL database using PHP
You've got a few things going on there, let's take them one by one:
1. Prevent SQL Injection vulnerability
Using the mysqli library is a step ahead from the (soon to be absolutely deprecated) mysql ...
- 181
5
votes
Function to get rows from database
This function copies the rows in reverse order. The resulting array would be weird if the query contained an ORDER BY clause.
The design of the function does not ...
- 143k
5
votes
User registration and authentication in PHP and PDO
Preamble
Writing a secure user management and authentication system is not an easy task. It has many pitfalls and you should follow a lot of guidelines and best practices along the way.
Security and ...
- 2,204
5
votes
Accepted
Email subscription queries for a PHP website
If you are using the mysqli functions, then do not call mysql_real_escape_string(), which is part of the deprecated mysql suite of functions. At the least, you ...
- 143k
Only top scored, non community-wiki answers of a minimum length are eligible