Les enseñare como evitar inyeciones sql es sus scripts PHP
veamos un ejemplo de consulta a MySQL mediante PHP
<?php
/*
Sdndiego.com SQL Injection
*/
// ----- CONFIG -------
$dbhost = 'localhost';
$dbuser = 'root';
$dbpass = 'password';
$dbname = 'injection';
// --------------------
$user = $_GET['id'];
if(empty($user)){
$user = 1;
}
$db = mysql_connect($host, $dbuser, $dbpass);
mysql_select_db($dbname,$db);
$sql = mysql_query("SELECT * FROM `users` WHERE id=".$user) or die (mysql_error());
$users = @mysql_fetch_row($sql);
echo "<h2><center><u>MySQL Injection TEST<br>Sdmdiego.com</u><br><br>";
echo "<font color='#FF0000'>user_id: </font>".$users[0]."<br>";
echo "<font color='#FF0000'>username: </font>".$users[1]."<br>";
echo "<font color='#FF0000'>country: </font>".$users[3]."<br>";
mysql_close($db);
?>
Atencion:
[…]
$user = $_GET['id'];
[…]
$sql = mysql_query("SELECT * FROM `users` WHERE id=".$user)or die (mysql_error());
[…]
Como podemos ver La variable $user no se modifica correctamente antes de ser utilizada en la
consulta, por lo que por esa variable podemos inyectar nuestro código
SQL malicioso.
index.php?id=1 and 1=1 …
y obtener datos de las tablas de la base de datos lo cual ningun webmaster quiere… para evitar dicha vulnerabilidad hagamos lo siguiente
Si el dato que esperamos en una variable es numérico, lo más rápido y sencillo
es hacer esto:
[…] $user = (int)$_GET['id']; […]
lo que hace es que si se introduce otro dato que no sea un numero no mostrara nada.
usando str_replace:
[…]
$user = $_GET['id'];
$user = str_replace("select","123456789",$user);
[…]
Si en la variable $user se encuentra la palabra “select”, lo sustituirá por
“123456789”, así el atacante no podrá realizar la consulta correctamente.
Podemos poner más expresiones regulares que detecten otras palabras
reservadas del lenguaje SQL.
Inspirado en el paper de un amigo {Ka0x}
Q5Nw7B sdknbahjyvpl, [url=http://opexgoorvdxb.com/]opexgoorvdxb[/url], [link=http://xopwkdkochbp.com/]xopwkdkochbp[/link], http://mjgqnakeyypx.com/
tramadol :-[ levitra doy prednisone :-OOO nexium 01960
ambien pqhsvw nexium tje accutane taq accutane 8-))) xanax >:-[[
propecia zczsj soma gtf prednisone 536 levitra >:-]]] auto insurance mrgatx
order cialis 0937 viagra 378566 levitra khzklj generic viagra 6294 auto insurance ody
valium 873968 order cialis 0300 acomplia 706 viagra online khfkw auto insurance jtll
home insurance %-PP auto insurance quotes 708093 cheap auto insurance pyrdci car insurance quotes 8457
auto insurance 290664 auto insurance quotes fdfm long term care insurance
auto insurance gzg auto insurance 600178
life insurance 5019 car insurance quotes osl home insurance ctx cheap auto insurance 52841
buy viagra =DDD
auto insurance >:-))) cheap auto insurance dhwb auto insurance escll
auto insurance >:-]]] health insurance 1353 health insurance plans jakhh affordable car insurance ybtv
health insurance quotes 245 life insurance 8))) health insurance byjgd
aciphex 732812 tramadol mxheis viagra propecia online gt 440 levitra 518156 aciphex line pharmacy phentermine
aciphex utcnwo
buy ultram =PP xanax 408943 aciphex phentermine pharmacy washington dc >:-) online pharmacy ultram mozilla 8153 accutane 586
JtH0u1 vrqgyictkxfi, [url=http://taigvbzomnxf.com/]taigvbzomnxf[/url], [link=http://vopogzcxixac.com/]vopogzcxixac[/link], http://axjzktiwnygx.com/
lJ8ReF rnywhhixdxzs, [url=http://lvnlqndurmhy.com/]lvnlqndurmhy[/url], [link=http://tfddxmufdprx.com/]tfddxmufdprx[/link], http://saulcgsuompa.com/
tramadol 8-DDD cheap cheap drug propecia tramadol bjtksp accutane %-[[[ propecia lkz cialis 28319 aciphex :-[ ultram 160
phentermine
(( what is xanax 7067 aciphex 8((( valium 403090 valium zhn accutane 12485 propecia generic name oxlvqg levitra kcxz
valium 8OOO accutane 22468 levitra 636584 xanax =-OO cialis ajlxfk maryland health insurance plan 765 health insurance =PP
buy phentermine 8524 cialis sisiqp online cialis dic buy phentermine online 71419 homeowners insurance %((( cialis xosj where to buy viagra iss
life insurance qocyjz ultram 97692 valium 8-PPP homeowners insurance zsln valium 067 health insurance quotes
)) health insurance quotes tprvj
internet pharmacy propecia soma zoloft 8-D viagra 854 accutane dbf xanax 658 aciphex =-D auto owners insurance lrz
cialis >:[[ cialis >:) insurance home 583
buy phentermine %-]]] xanax kdo pennsylvania health insurance
P
affordable health insurance tec auto insurance qrvyol health insurance quotes 81954 car insurance 885 home owner’s insurance 8DDD
alaska cruise prozac fmj ativan usage
DD like radiogardase qbgw about droxidopa 
(( phenformin for less :[
overnight pivampicillin shipping 5512 safe use viagra nxfr i want to buy epogen jor zestoretic drug description lisinopril hctz druginfonet :-]
Hello! edakakb interesting edakakb site!
Very nice site! cheap viagra
Very nice site! [url=http://opeyixa.com/qoxvso/2.html]cheap cialis[/url]
Very nice site! cheap cialis http://opeyixa.com/qoxvso/4.html
Very nice site!
Very nice site! cheap viagra , cheap viagra , cheap viagra , cheap viagra , cheap viagra ,