SQLi - <script>alert(8)</script>

[thesnarkie]

Hmm, kā lietotājs pamanījās ierakstīt komentāru: \"><script>alert(8)</script> , ka tas arī datubāzē saglabājās kā \"><script>alert(8)</script> ?

Ir taču mysql_real_escape_string pie POST['comment'].

 

 if(isset($_POST['postcomment'])) { 
  if(!$_POST['comment']) {
   echo $topview_news;
   echo "<div align='center'><table width='662' class='toutborder' cellspacing='2' cellpadding='2'><tr width='100%' class='tinborder'><td class='tinborder' align='center'>You didn't enter anything in comment field to post a comment. <a href='java script:self.history.back();' class='link'>Return</a>.</td></tr></table></body></html>";
   exit();
  }
  $username = $_SESSION['vards'];
  list($check) = mysql_fetch_row(mysql_query("SELECT `account_id` FROM `lietotaji` WHERE `username`='$username'",$connect));
  $account_id = $check;

  $news_id = mysql_real_escape_string($_POST['newsid']);
  $comment = mysql_real_escape_string($_POST['comment']);
  $result = mysql_query("INSERT `komentari` (`account_id`, `news_id`, `comment`,`datetime`) VALUES ('$account_id','$news_id','$comment',NOW())",$connect);

  echo $topview_news;
  echo "<div align='center'><table width='662' class='toutborder' cellspacing='2' cellpadding='2'><tr class='tinborder' width='100%'><td class='titlegreen' align='center'>Comment added. We will check it afterwards so be nice in your comments. <a href='java script:self.history.back();' class='link'>Return</a>.</td></tr></table></div></body></html>";
  exit();
}

Edited June 16, 2009 by thesnarkie

[codez]

mysql_real_escape_string eskeipo ', lai nevarētu ievietos SQL injekcijas, bet nekādi nepārbauda saturu, kurš saistīts ar HTML.

 

To tekstu, ko vēlies izvadīt kā HTML vajag vēl apstrādāt ar http://lv.php.net/htmlentities

Edited June 16, 2009 by codez

[thesnarkie]

Milzīgs paldies! *sabāž visur htmlentities*