CODEWITHSUNDEEP
php
phpnewbie
phpnewbie

Reputation: 43

$_GET php security

Do coding this way pose any security risks?

$test = $_GET['test'];
if($test) { 
$sql = mysql_query("SELECT * FROM tbl WHERE col2 = 'ABC'");
$row ...
}

Upvotes: 1

Views: 5128

Answers (7)

mohamed
mohamed

Reputation: 11

$test = $_GET['test']; if($test) { $sql = mysql_query("SELECT * FROM tbl WHERE col2 = 'ABC'"); $row ... }

if your $_GET is number same id can use

if(!is_numeric($test)){"echo "not numeric " ; } else { your code }

if your $_GET string you can use

function security ($test) { $test = str_replace ("""" , "" ,$test ); $test = str_replace ("<" , "" ,$test ); $test = str_replace (">" , "" ,$test ); $test = str_replace ("//" , "" ,$test ); $test = str_replace ("\" , "" ,$test ); $test = str_replace ("''" , "" ,$test ); $test = str_replace ("%" , "" ,$test ); $test = str_replace ("^" , "" ,$test ); $test = str_replace ("or" , "" ,$test ); $test = str_replace ("&" , "" ,$test ); $test = str_replace ("and" , "",$test );

return $test ; }

$test = security($test);
$sql = mysql_query("SELECT * FROM tbl WHERE col2 = 'ABC'");
$numrow = mysql_num_rows($sql);

if($numrow==0) { echo "error post" ; }
else { your code }

Upvotes: 1

vortex
vortex

Reputation: 852

$_GET[ "" ] is already escaped depending on your version if you are requiring to use it in a mysql query, read [5.3 deprecrated] http://www.php.net/manual/en/function.set-magic-quotes-runtime.php to find out more about how quotes are escaped.

also depending on your error_reporting function you might want to do a 

if(
   isset($_GET['test']) &&
   $_GET['test']!=''
){
   $test=$_GET['test'];

   #...
}

Upvotes: 0

Johann du Toit
Johann du Toit

Reputation: 2667

Only if the $_GET variable your testing for gives the user some sort of secret information from the database. But as the others have said this way your not open to SQL injection.

But without more information it's a bit hard to comment on the security of the script. As Security encompasses a large field and we are only able to comment on the code you gave us.

Upvotes: 0

Shakti Singh
Shakti Singh

Reputation: 86476

No, The code above does not have any security hole since you are not using the GET variable in any mysql query.

Look here for other security concerns

Upvotes: 4

drewm
drewm

Reputation: 1978

As long as you don't really mind if $test is true or false (and therefore if the code runs or not) then no there's no security risk to just testing the value.

Upvotes: 0

Arend
Arend

Reputation: 3772

Not nescesairily. But you provide too little to be sure. In general there are problems when you insert data from $_GET or $_POST into your sql (SQL Injection). This gives errors when people will start putting SQL code in the $_GET or $_POST, this is not the case right now.

For further reading, there are few lengthy volumes to get you up to speed on XSS and security:

Upvotes: 0

Andre Backlund
Andre Backlund

Reputation: 6953

No, you're only using $_GET to evaluate if the variable is true or false.

If you were to use it, unescaped, in your query just or even just echo it for the user, it would.

Upvotes: 0

Related Questions