72 lines
1.8 KiB
Plaintext
72 lines
1.8 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
$id = $_GET['id'];
|
|
mysql_connect('localhost', $username, $password) or die('Could not connect: ' . mysql_error());
|
|
mysql_select_db('myDatabase') or die('Could not select database');
|
|
|
|
$result = mysql_query("SELECT * FROM myTable WHERE id = " . $id); // Sensitive, could be susceptible to SQL injection
|
|
|
|
while ($row = mysql_fetch_object($result)) {
|
|
echo $row->name;
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
----
|
|
$id = $_GET['id'];
|
|
try {
|
|
$conn = new PDO('mysql:host=localhost;dbname=myDatabase', $username, $password);
|
|
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
|
|
|
|
$stmt = $conn->prepare('SELECT * FROM myTable WHERE id = :id');
|
|
$stmt->execute(array('id' => $id));
|
|
|
|
while($row = $stmt->fetch(PDO::FETCH_OBJ)) {
|
|
echo $row->name;
|
|
}
|
|
} catch(PDOException $e) {
|
|
echo 'ERROR: ' . $e->getMessage();
|
|
}
|
|
----
|
|
|
|
== Exceptions
|
|
|
|
No issue will be raised if one of the functions is called with hard-coded string (no concatenation) and this string does not contain a "$" sign.
|
|
|
|
----
|
|
$result = mysql_query("SELECT * FROM myTable WHERE id = 42") or die('Query failed: ' . mysql_error()); // Compliant
|
|
----
|
|
The current implementation does not follow variables. It will only detect SQL queries which are concatenated or contain a ``++$++`` sign directly in the function call.
|
|
|
|
----
|
|
$query = "SELECT * FROM myTable WHERE id = " . $id;
|
|
$result = mysql_query($query); // No issue will be raised even if it is Sensitive
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
include::../highlighting.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::comments-and-links.adoc[]
|
|
endif::env-github,rspecator-view[]
|