Skip to main content

How to prevent mysql sleep injections?


Recently, we faced an issue with website which was developed around one year back. One hacker successfully tried to slow the website using sleep injection. Although we were using precautions like mysqli_real_escape_string() for escaping SQL string syntax correctly. Let’s see why this happened then and what are the solutions?

We were using following code to get product id passed through query string.

$id   = mysqli_real_escape_string($con , (isset($_REQUEST['id']) ? $_REQUEST['id'] : 0));
$qry = "Select * from products where id = ".$id;

but hacker tried to change the the query string as : 

?id=3 and sleep(4)

and query becomes

Select * from products where id = 3 and sleep(4);

And it started taking around 4+seconds to run the query. So in this way website become too slow.

We were trying to figure out the possible and the best solution.

After spending some time we noticed that although we were using mysqli_real_escape_string() function but we were not using it properly. Everytime we use mysqli_real_escap_string(), the returned string must be used with single quotes although it’s numeric or string. So quick solution for that problem was to change the query as :

$id   = mysqli_real_escape_string($con , (isset($_REQUEST['id']) ? $_REQUEST['id'] : 0));
$qry = "Select * from products where id = ‘".$id."";

It is a quick solution but not the best one.

We could have also checked if the input is numeric or not.

Note : For future reference I would like to say please don’t use mysql_ extensions anymore. mysql_ extension is deprecated as of PHP 5.5, and will be removed in future.

Use mysqli or PDO prepared statements. Best is PDO statements.

The internet (and many respectable CS courses) are littered with examples using mysql_query() and string concatenation, half of which train people to create SQLI bugs or don't explain why escaping is needed; it's too late to undo the damage already done but at least people new to PHP will hopefully be told now that there is a better way. Although we can’t say PDO is 100% not vulnerable to errors but we don’t need to use external functions to cover sql injections. So as a programmer I would suggest and request to all the developers community to use PDOs in future reference.

Reference :


Thanks!!!!!!!!!!!!!! Enjoy Programming :)


Comments

Popular posts from this blog

Odoo/OpenERP: one2one relational field example

one2one relational field is deprecated in OpenERP version>5 but you can achieve the same using many2one relational field. You can achieve it in following two ways : 1) using many2one field in both the objects ( http://tutorialopenerp.wordpress.com/2014/04/23/one2one/ ) 2)  using inheritance by deligation You can easily find the first solution with little search over internet so let's start with 2nd solution. Scenario :  I want to create a one2one relation between two objects of openerp hr.employee and hr.employee.medical.details What I should do  i. Add _inherits section in hr_employee class ii. Add field medical_detail_id in hr_employee class class hr_employee(osv.osv):     _name = 'hr.employee'     _inherits = {' hr.employee.medical.details ': "medical_detail_id"}     _inherit = 'hr.employee'         _columns = {              'emp_code':fields.char('Employee Code', si

Odoo: Download Binary File in v10

To download any binary file in Odoo10 following is the link: http://127.0.0.1:8069/web/content?model=<module_name>&field=<field_name>&filename_field=<field_filename>&id=<object_id> module_name    - the name of the model with the Binary field field_name         - the name of the Binary field object_id            - id of the record containing particular file. field_filename    - name of a Char field containing file's name (optional). So if you want to call a function on button click and download the file, code is as follow: file_url = "http://127.0.0.1:8069/web/content?model=<module_name>&field=<field_name>&filename_field=<field_filename>&id=<object_id>" return {     'type': 'ir.actions.act_url',     'url': file_url,     'target': 'new' } In Reports or web page, you can use it as: <t t-foreach="files&qu

Odoo/ OpenERP: Customize one2many relational field

I was working on one2many relational field to integration one functionality. Worked on python code and then wrote an xml file for the same. Restarted my server. It showed me the row with headers and 'Add an item' button. When clicked on that it opened a pop-up to provide inputs. It shows all the fields with in sequence of it's own. Q1. I need input fields in other sequence or don't need all fields. A.   In xml you would have wrote code like this : <field name="dirtyhandsphp" widget="one2many_list" colspan="4" nolabel="1"> <tree string="Details">              <field name="field1" />              <field name="field2" />                      ---------------------------------------------              <field name="designation" />         </tree>                                                     </field> Add form section inside and