所有$ _POST的mysql_real_escape_string

Question

I have a old system without any check for sql injection and I want to add mysqli_real_escape_string() every time user intract with the DB.

All of the system is built under index.php. the page look like that:

if (!isset($_GET['p'])) {
    $_GET['p'] = 'main';
}

if (!file_exists($_GET['p'].".php"))    {
    echo "The page you are looking for isn't exist.";
}   else    {   
    if (logs()) {
        include($_GET['p'].".php");
    }
    else    {
        include('not_register.php');
    }
}

I thought of just adding this code in the top oh index.php and I wanted to be sure I'm not messing up with anything so i'm asking here.

foreach ($_POST as $name => $val)   {
    $_POST[$name] = mysqli_real_escape_string($db, $val);
}

This code running every reload of page will have any negative influence?

thx.

Answer 1

This:

I want to add mysql_real_escape_string() every time user intract with the DB.

Is a good goal for legacy mysql code that is using mysql_* functions. However, this:

foreach ($_POST as $name => $val) { $_POST[$name] = mysqli_real_escape_string($db, $val); }

is a different thing. You're not adding it to every time user interacts with DB, you're adding it done every time, before anything else has been done. The function needs a connection to the database, so if you don't have such a connection in a page that uses these variables, you immediately hit into issues. Furthermore, you can break any handling of those variables that might not expect the values to be escaped at this point - they should be escaped for DB usage, so immediately before using them with the database, not before that.

---

Also, as others have noted, your code is vulnerable to injections with your include pattern. file_exists can be used with network shares, file paths as well as some url wrappers. To quote file_exists manual entry :

As of PHP 5.0.0, this function can also be used with some URL wrappers. Refer to Supported Protocols and Wrappers to determine which wrappers support stat() family of functionality.

Even without url wrappers, a malicious user can use your include to directly include some server configs and other files you don't want to be included.

Answer 2

First.

Running this question an a loop will help noone. In fact, you just reinvented a notorious magic quotes feature, that is already removed from the language. For a reason.

Second.

It is NOT good goal for legacy mysql code that is using mysql_* functions. Just because this function has nothing to do with injections at all.

If you have only 25 pages - just review them all and rewrite SQL handling code properly