[PHP] Anti SQL Injection Script

[[N]asser]

Well, to start things off, this is a modded version of one that was posted by someone else...I forgot his name, but if you search for it, I'm sure you could find it. I've added more things to it to make it more secure and reliable. Here they are:

// Anti-SQL Injection
function check_inject()
  {
    $badchars = array(";", "'", "\"", "*", "DROP", "SELECT", "UPDATE", "DELETE", "-");
  
    foreach($_POST as $value)
    {
      if(in_array($value, $badchars))
      {
        die("SQL Injection Detected\n<br />\nIP: ".$_SERVER['REMOTE_ADDR']);
      **
      else
      {
        $check = preg_split("//", $value, -1, PREG_SPLIT_OFFSET_CAPTURE);
        foreach($check as $char)
        {
          if(in_array($char, $badchars))
          {
            die("SQL Injection Detected\n<br />\nIP: ".$_SERVER['REMOTE_ADDR']);
          **
        **
      **
    **
  **

This also works faster by a few mili seconds. This is the first of many PHP releases that I will be making to RaGEZONE. I use this very same script on the KolieMU site (soon to come). I hope you enjoy it.

[N]asser` ~ Out

 

[Dorin1]

wow tnx

 

[[N]asser]

No problem.

[N]asser` ~ Out

 

[[N]asser]

I've also newly added a new character into the array..."-". If you have this script check for injection on your stats adder, it should stop the - bug.

[N]asser` ~ Out

 

[DataMatrix]

I don't know why people continue using this type of anti-sql-inject, I use this:

if ((eregi("[^a-zA-Z0-9_-]", $memb___id)) || (eregi("[^a-zA-Z0-9_-]", $memb__pwd))) {
	echo("SQL Injection Detected");
**

 

[themad]

I don't know why people continue using this type of anti-sql-inject, I use this:

if ((eregi("[^a-zA-Z0-9_-]", $memb___id)) || (eregi("[^a-zA-Z0-9_-]", $memb__pwd))) {
	echo("SQL Injection Detected");
**

hahhahaha hahahaha that Echo will not protect a thing

 

[Nemesiz]

we can change echo("SQL Injection Detected"); to die("SQL Injection Detected");

 

[messmaker]

But i Didnt Understand How i put this Where need to do somthing?

 

[DataMatrix]

Hmm, it echo does the job on my server, but thanks for the tip, i'll change to die.

hahhahaha hahahaha that Echo will not protect a thing

PS: Was there any need in that big gay butt laugh?

 

[[N]asser]

Yea, it was fun. By the way, this script is very effective, even though very simple.

[N]asser` ~ Out

 

[Nemesiz]

to protect from sql injection i think need to make check of length of login and password

 

[[N]asser]

to protect from sql injection i think need to make check of length of login and password

Why? You know what injection is right? Here's an example...in a form that submits to your db, for example your login you put this:

Username: bob; DROP TABLE Character;

Yea, that's bascially it and that's what my script protects you against.

[N]asser` ~ Out

 

[fancy]

I don't know why people continue using this type of anti-sql-inject, I use this:

if ((eregi("[^a-zA-Z0-9_-]", $memb___id)) || (eregi("[^a-zA-Z0-9_-]", $memb__pwd))) {
	echo("SQL Injection Detected");
**

don't u think u should u use exit() ?

if ((eregi("[^a-zA-Z0-9_-]", $memb___id)) || (eregi("[^a-zA-Z0-9_-]", $memb__pwd))) {
	echo("SQL Injection Detected");
        exit();
**

exit() stops the script. So after detecting sql injection script stops and nothing happens ~

 

[Nemesiz]

[N]asser "bob; DROP TABLE Character;" its 26 simbols. Username max is 10 simbols. Event is player enter his name "mylonglongname" its 14 simbols. SQL insert only 10. To protect from sql injection and bugs username need to be checked using eregi("[^a-z0-9_-]", $memb___id) (is you use big letters you make a bug).
If player want to use username "drop" your $badchars = array(";", "'", "\"", "*", "DROP", "SELECT", "UPDATE", "DELETE", "-"); dont helps to him.

fancy want do you think die() do ?

 

[DataMatrix]

die stops the script too, like echo then exit.

 

[themad]

or just this

if ((eregi("[^a-zA-Z0-9_-]", $memb___id)) || (eregi("[^a-zA-Z0-9_-]", $memb__pwd))) {
	die("<font color=red><b>SQL Injection Detected</font</b>");
**

 

[messmaker]

[I REPEAT]But i Didnt Understand How i put this Where need to do somthing?

 

[Nemesiz]

Try to learn php

 

[[N]asser]

[I REPEAT]But i Didnt Understand How i put this Where need to do somthing?

Put the code I gave you in a page and save it as functions.php...Then on whichever page you want to call the script, use this:

include_once('functions.php');
check_inject();

That's about it.

[N]asser` ~ Out

 

[messmaker]

Quote:
Originally Posted by messmaker
[I REPEAT]But i Didnt Understand How i put this Where need to do somthing?

Put the code I gave you in a page and save it as functions.php...Then on whichever page you want to call the script, use this:

PHP Code:
include_once('functions.php');
check_inject();

But tell me I understand i put in a page with that script whit named functions Php but.... this i didn't understand
PHP Code:
include_once('functions.php');
check_inject();