|
I've 3 php files,
1.converter.php // controllers/converter.php
<?php
defined('BASEPATH') OR exit('No direct script access allowed');
class Converter extends CI_Controller{
function __construct(){
parent::__construct();
$this->load->helper(array('url','form'));
}
function index(){
$this->load->view('menu_converter');
}
function biner(){
$this->load->library('form_validation');
$this->form_validation->set_rules('n1', 'Number1', 'required|integer');
if ($this->form_validation->run()){
$data['n1']=(int)$this->input->post('n1', true);
$data['hasil']=decbin((int)$data['n1']);
}
else{
$n1=0;
}
$this->load->view('biner',$data);
}
}
?>
2.menu_converter.php // view/menu_converter.php
<<pre lang="xml">html>
<head><title>Aplikasi Converter Bilangan</title>
</head>
<body>
<h1>CodeIgniter 2.0 and Form!</h1>
<p>Silahkan pilih menu di bawah ini.</p>
<ul>
<li><?php echo anchor('index.php/converter/biner/','Biner');?>
</ul>
<p><br/>Page rendered in {elapsed_time} seconds</p>
</body>
</html></pre>
3.biner.php // view/biner.php
<html>
<head><title></title>
</head>
<body>
<h1>Converter</h1>
<?php echo validation_errors();?>
<p>Silahkan masukkan data berikut!</p>
<?php echo form_open('index.php/converter/biner');?>
<?php echo form_input('n1',$n1);?>
<?php echo form_submit('submit','Hitung!!');?>
<?php echo form_close();?><br>
Hasil: <?php echo $hasil;?>
<p><br/>Page rendered in {elapsed_time} seconds</p>
</body>
</html>
I'm using CodeIgniter. Everytime i run the "index.php/converter" on my browser, it keeps show error when trying to load "biner.php" view file. I hope someone can help me finding if there's something i've missed. Thank you.
|
|
|
|
|
I finally get it. It's not just the code I use to execute the ExecuteScalar method but it is mainly the code up stream that is executing the class. It is everything calling your code. That said, now can I get someone to look at the up stream code causing my SQL injection errors. First I will show you two examples of the code calling my code, then the calling code, and finally the executing code, which I formulated and displayed from a previous post.
Calling code with Three parameters:
public bool isTamAsp(int aspKey, int fy, string accountCode)
{
MyParam myParam;
string sqlQuery = "select isTamMacom = count(macom_key) FROM hier_fy " +
"WHERE hier_key = @aspKey AND fy = <a href="http:
QueryContainer Instance = new QueryContainer(sqlQuery);
myParam = new MyParam();
myParam.SqlParam = new SqlParameter("@aspKey", Instance.AddParameterType(_DbTypes.Int));
myParam.SqlParam.Value = aspKey;
Instance.parameterList.Add(myParam);
myParam = new MyParam();
myParam.SqlParam = new SqlParameter("@fy", Instance.AddParameterType(_DbTypes.Int));
myParam.SqlParam.Value = fy;
Instance.parameterList.Add(myParam);
myParam = new MyParam();
myParam.SqlParam = new SqlParameter("@accountCode", Instance.AddParameterType(_DbTypes._string));
myParam.SqlParam.Value = accountCode;
Instance.parameterList.Add(myParam);
if (Convert.ToInt32(ExecuteScaler(Instance)) < 1)
return false;
return true;
}
<pre>
Calling code with no parameters:
<pre>
Calling code with no parameters:
<pre>
public long GetMarinesUploadNextUploadKey()
{
string query = "SELECT MAX(upload_key) FROM temp_auth_usmc_upload";
QueryContainer Instance = new QueryContainer(query);
string result = Convert.ToString(ExecuteScaler(Instance));
if (string.IsNullOrEmpty(result))
return 1;
else
return Convert.ToInt64(result) + 1;
}
<pre>
Code calling my previous code with three parameters:
<pre>
public bool isTamAsp(int aspKey, int fy, string accountCode)
{
return e581provider.isTamAsp(aspKey, fy, accountCode);
}
<pre>
Method calling the SQL executing my code:
<pre>
DbCommand command = _provider.CreateCommand();
command.Connection = _connection;
{
command.CommandText = Instance.Query;
command.CommandType = CommandType.Text;
if (Instance.parameterList.Count > 0)
{
foreach (var p in Instance.parameterList)
{
command.Parameters.Add(p.SqlParam);
}
}
if (_useTransaction) { command.Transaction = _transaction; }
try
{
returnValue = command.ExecuteScalar();
}
<pre>
My Class containing the SQL string and the cmd parameter List
<pre>
public enum _DbTypes
{
Int = 1, _string = 2, _long = 3, _bool = 4, _DateTime = 5,
_decimal = 6, _float = 7, _short = 8, _bite = 9
}
public class MyParam
{
public SqlParameter SqlParam { get; set; }
}
public class QueryContainer
{
string _query;
public List<myparam> parameterList = new List<myparam>();
public QueryContainer(string query) { _query = query; }
public SqlDbType AddParameterType(_DbTypes id)
{
switch (id)
{
case _DbTypes.Int:
return (SqlDbType)Enum.Parse(typeof(SqlDbType), "int", true);
case _DbTypes._string:
return (SqlDbType)Enum.Parse(typeof(SqlDbType), "NVarChar", true);
case _DbTypes._long:
return (SqlDbType)Enum.Parse(typeof(SqlDbType), "SqlDbType.BigInt", true);
case _DbTypes._bool:
return (SqlDbType)Enum.Parse(typeof(SqlDbType), "SqlDbType.Bit", true);
}
return SqlDbType.VarChar;
}
public string Query
{
get
{
return _query;
}
set { _query = value; }
}
}
<pre>
|
|
|
|
|
I don't see a concatenated query there. What would be your question here?
Sidenote: You nested 10 (!) code-blocks into each other in your message. Which makes it hard to read. Please use a single code block or, if multiple, not nested into each other.
If the brain were so simple we could understand it, we would be so simple we couldn't. — Lyall Watson
|
|
|
|
|
This is one of the concatenate queries:
string sqlQuery = "select isTamMacom = count(macom_key) FROM hier_fy " +
"WHERE hier_key = @aspKey AND fy = <a href="http:
<pre>
|
|
|
|
|
It's concatenated with a + but it's not concatenating values as literals. All required values are either hard-coded (like "3,4,7,8") or provided via Sql-parameters.
If the brain were so simple we could understand it, we would be so simple we couldn't. — Lyall Watson
|
|
|
|
|
You're only concatenating constant strings, not user input or other variables, so there's no vulnerability in that example. You could easily remove the concatenation and declare the query in a single string:
const string sqlQuery = "select isTamMacom = count(macom_key) FROM hier_fy WHERE hier_key = @aspKey AND fy = @fy AND @accountCode NOT IN (3,4,7,8) AND macom_key IN (select hier_key from lkup_e581_MacomThatRequireTAM) AND is_visible = 1 AND is_active = 1";
If you want to split the string onto multiple lines for readability, use a verbatim string literal:
const string sqlQuery = @"select
isTamMacom = count(macom_key)
FROM
hier_fy
WHERE
hier_key = @aspKey
AND
fy = @fy
AND
@accountCode NOT IN (3,4,7,8)
AND
macom_key IN
(
select hier_key
from lkup_e581_MacomThatRequireTAM
)
AND
is_visible = 1
AND
is_active = 1";
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
One of the concerns that I have is that if the query string has no parameters could that show up as a finding?
|
|
|
|
|
Presumably, the tool has detected that you've used string concatenation on your query, without actually checking whether the strings are variables or constants.
If you mark all of your query strings as const, that should get rid of the warnings, as well as making sure you don't have any SQLi vulnerabilities left.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
As I've never worked with the tool you're using for SQL-injection-checking I can't tell for sure; but the "error"-report that you posted recently read like it bases its checks not on statically analyzing your code (the sql-statements) but on attempted (harmless) injections (and then identifying the injected values when they reappear in the finally executed sql). Which, if I'm right here, would mean that the tool would not stumble upon your harmless constant string concatenation here. It would mean that there's other code somewhere which actually still is susceptible to SQL-injection.
Richard's suggestion to mark all your query strings as const will definitely help.
If the brain were so simple we could understand it, we would be so simple we couldn't. — Lyall Watson
|
|
|
|
|
I am trying to create my own theme and I am using the "wp_nav_menu()" function but, it is not working. The documentation on wordpress.org says that the function should return true if it finds the location and false if it doesn't. My function returns no value which leads me to believe that the PHP is not recognizing the function call. Could someone help me out? I am new to WordPress and out of ideas.
Thanks,
Kevin Haynes
modified 29-May-15 2:49am.
|
|
|
|
|
Hi,
I saw this article:
[^]
and I would like to ask if it's possible to host the DLL in PHP nstead of WPF? and how?
Thanks
Jassim[^]
Technology News @ www.JassimRahma.com
|
|
|
|
|
Message Removed
modified 22-May-15 14:38pm.
|
|
|
|
|
Hi All,
I have been given an existing WordPress project for a website, I am trying to open it, and I am not able to find which software should I have to open a WordPress project for adding new code to the Project.
Any link, code snippet or even a suggestion helps me great.
Thanks in advance.
Thanks,
Abdul Aleem
"There is already enough hatred in the world lets spread love, compassion and affection."
|
|
|
|
|
|
This is very similar to a previous post but with different code.
I have to eliminate a SQL injection error from within a method. Now, with only minor modifications this error must be eliminated. Here is the description from the scan:
Attack vector: system_data.system.data.IDbCommand.ExecuteReader
Description: The database query contains a sql injection flaw. The call to system_data_dll.System.Data.IDbCommand.ExecuteReader constructs a dynamic sql query using a variable derived from user-supplied input. An attacker could exploit this flaw to execute arbitrary sql queries against the database. ExecuteReader was called on the command object, which contains tainted data. The tainted data originated from earlier calls to system_data_dll.data.common.dbcommand.executereader, System_web_dll.system.web.httprequest.get_params, system_web_dll.data.common.dbadapter_fill, system_data_dll.system.data.common.dbwommand.executescarar and system_web_dll.system.web.httprequest.get_form
Code:
protected DataTable ExecuteDataTable(DbCommand command, ParamData[] pDataArr)
{
DataTable returnValue = null;
try
{
if (_connection == null)
OpenConnection();
else
{
if (_connection.State == ConnectionState.Closed)
OpenConnection();
}
command.Connection = _connection;
command.CommandType = CommandType.Text;
command.CommandTimeout = 12000;
for (int i = 0; i < pDataArr.Length; i++)
{
DbParameter parameter = command.CreateParameter();
parameter.ParameterName = pDataArr[i].pName;
parameter.DbType = pDataArr[i].pDataType;
parameter.Value = pDataArr[i].pValue;
command.Parameters.Add(parameter);
}
returnValue = new DataTable();
DbDataReader reader;
reader = command.ExecuteReader();
using (reader)
{
returnValue.Load(reader, LoadOption.OverwriteChanges);
}
reader.Close();
if (!KeepAlive && _connection.State == ConnectionState.Open)
{
CloseConnection();
}
}
catch (Exception e)
{
if (e is EntryPointNotFoundException)
throw e;
_iserror = true;
LogBLL bll = new LogBLL();
bll.WriteErrorLog(e);
}
pDataArr = null;
return returnValue;
}
Thanks in advance!
modified 12-May-15 17:16pm.
|
|
|
|
|
I assume that it's the same thing as in your previous question. Though there are SQL-parameters used in this method, it gets its command-object passed as an argument with the command-text apparently already assigned. I guess the calling code concatenates some values (other than there are in pDataArr) as literals into the query string.
If the brain were so simple we could understand it, we would be so simple we couldn't. — Lyall Watson
|
|
|
|
|
I saw a very good answer to my question about parameterizing a string with the actual parameters; how would I know whether the command was an UPDATE, INSERT, or a DELETE?
SqlCommand cmd = new SqlCommand(commandText, connection);
SqlParameterCollection sp = cmd.Parameters;
List<SqlParameter> sp = new List<SqlParameter>()
{
new SqlParameter() {ParameterName = "@CmpyCode", SqlDbType = SqlDbType.NVarChar, Value= CV.Global.CMPYCODE},
new SqlParameter() {ParameterName = "@Code", SqlDbType = SqlDbType.NVarChar, Value = codeName},
new SqlParameter() {ParameterName = "@DisplayCode", SqlDbType = SqlDbType.NVarChar, Value = codeName + "-"},
new SqlParameter() {ParameterName = "@TotalDigit", SqlDbType = SqlDbType.Int, Value = CV.Global.PARAMTOTALDIGIT}
};
insertData(CV.Sps.SP_INSERT_PARAM_TABLE, sp);
SqlCommand cmd = new SqlCommand();
cmd.Parameters.AddRange(parameterPasses.ToArray());
|
|
|
|
|
Steve Holdorf wrote: how would I know whether the command was an UPDATE, INSERT, or a DELETE?
I'm a bit confused - what is the context for this question? I don't see how it is related to your previous questions. And I don't see why you posted that code, which appears to be three separate fragments?
If the brain were so simple we could understand it, we would be so simple we couldn't. — Lyall Watson
|
|
|
|
|
OK. Let me explain. I have found some code that I think will work but how would I know what sql command it would be. See code below:
SqlCommand cmd = new SqlCommand(commandText, connection);
SqlParameterCollection sp = cmd.Parameters;
List<SqlParameter> sp = new List<SqlParameter>()
{
new SqlParameter() {ParameterName = "@CmpyCode", SqlDbType = SqlDbType.NVarChar, Value= CV.Global.CMPYCODE},
new SqlParameter() {ParameterName = "@Code", SqlDbType = SqlDbType.NVarChar, Value = codeName},
new SqlParameter() {ParameterName = "@DisplayCode", SqlDbType = SqlDbType.NVarChar, Value = codeName + "-"},
new SqlParameter() {ParameterName = "@TotalDigit", SqlDbType = SqlDbType.Int, Value = CV.Global.PARAMTOTALDIGIT}
};
insertData(CV.Sps.SP_INSERT_PARAM_TABLE, sp);
SqlCommand cmd = new SqlCommand();
cmd.Parameters.AddRange(parameterPasses.ToArray());
|
|
|
|
|
You didn't explain a whole lot 
Am I right in assuming that you want to change your code to use stored procedures instead of 'text-statements' (CommandType.Text) and in order to execute the right one, need to know if it should be an UPDATE, INSERT, or DELETE ?
If the brain were so simple we could understand it, we would be so simple we couldn't. — Lyall Watson
|
|
|
|
|
No. I still have to use the static command but eliminate the hard coded parameters. That being the case I want to use the technique above for passing in the parameters, use the loop, which is the problem to begin with, to fill in a parameterized string like so:
command.CommandText = ("INSERT INTO TABLE (result, title, des) values(@store_result, @store_title, @store_des)");
-- modified 12-May-15 20:39pm.
|
|
|
|
|
I still can't follow you completely. You're omitting some steps of your train of thought 
The method in your original post takes a DbCommand and ParamData[], already has some kind of parameter-filling-loop and then runs an ExecuteReader(). The DbCommand apparently already has a SELECT-statement assigned and my assumption was that this statement already contains some values as literals, which is why the method failed your SQL-injection test, despite the rest of the values are added via parameters.
As you're now quoting an INSERT-statement, you must be talking about some completely different method that I've not seen yet. Please post that method and also the calling code and maybe elaborate on why using a loop to create the parameters is a problem.
If the brain were so simple we could understand it, we would be so simple we couldn't. — Lyall Watson
|
|
|
|
|
Lefevre,
You make a good point about me being confused. I really can't show you anything that doesn't require a loop. I have three other findings that are simple hard coded commands with parameters as part of the string. This is what I showed you in my first post that you answered before this one. In every case a loop is required to add the sql parameters to the command. I have been looking for some kind of Lambda expression to add the values to the sql command parameter list which I can not find.
|
|
|
|
|
How about we deal first with the method you posted in your original question? 
To help you further with that, I would like to see the calling code - can you post that?
/Sascha
If the brain were so simple we could understand it, we would be so simple we couldn't. — Lyall Watson
|
|
|
|
|
I think I have a solution. Can someone review the solution and let me know what they think?
The Singleton created with it's _id property that is passed in from the calling function:
public class QueryContainer
{
private static List<querycontainer> Container;
private static QueryContainer instance;
private int _id;
public int _searchID;
private string _query;
private QueryContainer () { }
public static QueryContainer Instance
{
get {
if (Instance == null)
{
instance = new QueryContainer();
}
return instance;
}
}
public string Query { get { return Container.Find(instance => instance._id == _searchID).Query; }
set { Container.Query = value; _id =+ 1; } }
}
}
}
public int ID { get { return _id; } }
}
The calling code that passes the id to access the query string from the singleton:
protected object ExecuteScaler(int id)
{
object returnValue = null;
Container Instance = new Container ();
Instance.searchID = id;
DbCommand command = _provider.CreateCommand();
command.Connection = _connection;
command.CommandText = Instance.Query;
command.CommandType = CommandType.Text;
if (_useTransaction) { command.Transaction = _transaction; }
try
{
returnValue = command.ExecuteScalar();
}
...
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
