Skip to content

Instantly share code, notes, and snippets.

@krisatkinson

krisatkinson/bettermysql-sanitize-input.php

Forked from terrymun/bettermysql-sanitize-input.php
Last active August 29, 2015 14:27
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save krisatkinson/1d571a6d4f61f15353d7 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save krisatkinson/1d571a6d4f61f15353d7 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @terrymun terrymun revised this gist Aug 19, 2015. No changes.
  2. @terrymun terrymun revised this gist Aug 19, 2015. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion bettermysql-sanitize-input.php
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    <?php
    // Assuming that database connection is established via $db object
    // Assuming that database connection is already open

    // Let's say a user is allowed to provide a table name to query from
    $tableName = trim($_GET['tableName']);
  3. @terrymun terrymun revised this gist Aug 18, 2015. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion bettermysql-sanitize-input.php
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,7 @@
    // Assuming that database connection is established via $db object

    // Let's say a user is allowed to provide a table name to query from
    $tableName = $_GET['tableName'];
    $tableName = trim($_GET['tableName']);

    // This would NOT work (no good!)
    $stmt = $db->prepare("SELECT user, id, email FROM :table WHERE id > 1000");
  4. @terrymun terrymun created this gist Aug 18, 2015.
    26 changes: 26 additions & 0 deletions bettermysql-sanitize-input.php
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,26 @@
    <?php
    // Assuming that database connection is established via $db object

    // Let's say a user is allowed to provide a table name to query from
    $tableName = $_GET['tableName'];

    // This would NOT work (no good!)
    $stmt = $db->prepare("SELECT user, id, email FROM :table WHERE id > 1000");
    $stmt->bindParam(':table', $tableName);
    $stmt->execute();
    // More...

    // This would work (OSSOM)
    // Check user input against a whitelist
    $tableNames = array('userdata1', 'userdata2', 'userdata3');

    // If user input matches an entry within the whitelist, go ahead
    if(in_array($tableName, $tableNames)) {
    $stmt = $db->prepare("SELECT user, id, email FROM `$tableName` WHERE id > 1000");
    $stmt->execute();
    // More...
    } else {
    // Throw an error
    }

    ?>