Hey guys,
First of all, I know this code is really unorganised and that mysql functions are deprecated and should not be used, however I’m working for someone on a very old website and I need to check that the code protects against SQL injection.
Normally I would use PDO and prepared statements but again its an old website and I’m just using mysql_real_escape_string which apparently is used to protect against SQL injection however I’ve not used it before so I don’t know for certain.
The script is used on an admin panel to make a new php page. Again, I would normally use a different approach but it just has to be done this way. The code creates a page using fopen and fwrite then on the page it gets the content from the database however the SQL query didn’t work without the $value variable being wrapped in quotes so I wrote a quick function to do this.
It uses the $_SERVER[‘REQUEST_URI’] value e.g. the file name to select the information from the database and the $value variable is being escaped using mysql_real_escape_string before being passed to the query.
Is the code secure and will it stop SQL injection? Again I know it’s a mess, you should see the rest of the site, it’s a disaster.
Thanks,
Adam
[php]
function quotes($string) {
return “’” . $string . “’”;
}
function escapeString($data){
return mysql_real_escape_string($data,$this->curcon);
}
$content = '<?php
include_once “header.php”;
include_once “menu.php”;
$url = parse_url($_SERVER[“REQUEST_URI”]);
$path = str_replace("/","",$url[“path”]);
$value = $db->escapeString($path);
$sql = mysql_query("SELECT * FROM static_pages WHERE url = " . quotes($value));
$results = mysql_fetch_assoc($sql);
?>
<?php echo stripslashes($results["pageTitle"])?>
$file = fopen(’…/’ . $_POST[“url”],“w”);
$write = fwrite($file,$content);
$close_file = fclose($file);
[/php]