CODEWITHSUNDEEP
javascriptphpsqlreactjsweb-hosting
Tedis Rozenfelds
Tedis Rozenfelds

Reputation: 27

Fetch POST to send DELETE query to MySQL - is it safe?

Since many web hosting websites (such as infinityfree and 000webhost) block HTTP DELETE requests I found a way how to send DELETE query to MySQL by adding a password to HTTP POST body which triggers PHP to send DELETE query to MySQL.

But is this safe since the password is visible in Front End and so visible to any site visitor? Can someone do harm to my database by using this password like making SQL injection?

In React JS:

async function sendDeleteRequest(i) {
const bodyWithPassword = {
  ...props.updatedProducts[i],
  password: "kfI2KiIMOibKn0X98ufe$#!G^z78FNbbvI!fng0p*vk",
};
await fetch(Links["products"], {
  method: "POST",
  body: JSON.stringify(bodyWithPassword),
  headers: {
    "Content-Type": "application/json",
  },
});
await props.refreshProductListContent();

}

In PHP:

//If HTTP body has password send DELETE query.
                if ($json["password"] = "kfI2KiIMOibKn0X98ufe$#!G^z78FNbbvI!fng0p*vk") {
                    $deleteProduct = new $json["productType"]($json);
                    $deleteProduct->deleteProduct($json);
                    return;
                }
                //If password isn't added in the body add product to database
                $newProduct = new $json["productType"]($json);
                $newProduct->addProduct($json, $newProduct);

Upvotes: 0

Views: 347

Answers (1)

Raimonds Liepiņš
Raimonds Liepiņš

Reputation: 148

The short answer is - This is not safe

Having a hard-coded password in ReactJS, which is a client-based Javascript code, means that it's accessible to anyone who visits and loads the Javascript file. Anyone can read it, use it and abuse it.

There is not enough code provided to see if there is a SQL injection vulnerability as such. You should review deleteProduct and addProduct functions and see if you have parameterized all the parameters passed to a SQL query.

In a scenario where your code was vulnerable to a SQL injection, anyone can grab the client-side encoded password and abuse the SQL injection vulnerability.

Regarding the request type, there is no actual difference between a POST and a DELETE request (technically speaking), apart from how your server side code processes it, which is what you write and decide. Obviously the development world has agreed to common sense on which each of the methods does here https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods, which you should oblige by when doing development.

Upvotes: 1

Related Questions