表单中的SQL注入

Question

I test my site with Acunetix Web Vulnerability Scanner 8 and its say that i have 2 sql injection in my register page

URL encoded POST input email was set to 1##xa7## URL encoded POST input username was set to 1##xa7##

Error message found: supplied argument is not a valid MySQL result

Php code for these two

 $username = mysql_real_escape_string(trim($_POST['username']));
 $email = mysql_real_escape_string(trim($_POST['email']));

        if ($username==!preg_match('/^[a-zA-Z0-9._]+$/', $username)){
         $error_stat = 1; 
              $message_error .= 'Error:invalid username.';
        }
         elseif (!filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL)) {
            $error_stat = 11; 
              $message_error .= 'Error:invalid email.';

          }

So how this can be vulnerable to sql injection

@Pekka

 $checkusername = mysql_query("SELECT Username FROM users WHERE Username = '$username'");
    $checkemail = mysql_query("SELECT EmailAddress FROM users WHERE EmailAddress = '$email'");

    $username_exist = mysql_num_rows($checkusername);
    $email_exist = mysql_num_rows($checkemail);

And if one of them exist to show error:

<?php if ($error_stat > 0){ echo $message_error; }?>

If there is no errors

$registerquery = mysql_query("INSERT INTO users (Username, password, EmailAddress,Activation,registered) VALUES('".$username."', '".$password."', '".$email."','".$activation."','".$date."')");

EDIT //

So guys i make a another page with PDO and new error is:

SQLSTATE[HY000]: General error: 1267 Illegal mix of collations (cp1251_general_ci,IMPLICIT) and (utf8_general_ci,COERCIBLE) for operation '='

This what the Acunetix show when i click on Launch the attack with HTTP Editor.And the username used by program is 1%c0%00xa7%c0a2

PDO

By the program the username is = 1%c0%00xa7%c0a2 and error is in line 32

 line 30 $getMail = $dbh->prepare("SELECT EmailAddress FROM users WHERE username = :username");
    line 31 $getMail->bindParam(':username', $username);
    line 32 $getMail->execute();
    line 33 $rowMail = $getMail->fetch();
    line 34 $email = $rowMail['emailaddress'];

Answer 1

From what I can tell you should escape all fields in here:

$registerquery = mysql_query("INSERT INTO users (Username, password, EmailAddress,Activation,registered) VALUES('".$username."', '".$password."', '".$email."','".$activation."','".$date."')");

You have:

$username = mysql_real_escape_string(trim($_POST['username']));
 $email = mysql_real_escape_string(trim($_POST['email']));

You should have the same for $password, $activation and $date... Not sure if you do

Anyway I use normally use this:

function getPost($s) {
        if (array_key_exists($s, $_POST))
            return mysql_real_escape_string(htmlspecialchars($_POST[$s]));
        else return false;
    }


    function getGet($s) {
        if (array_key_exists($s, $_GET))
            return mysql_real_escape_string(htmlspecialchars($_GET[$s]));
        else return false;
    }

But it's to protect against XSS also... I though you should be safe with mysql_real_escape_string().

Anyway you can also use Prepared statements and forget all about this!! http://php.net/manual/en/pdo.prepared-statements.php

EDIT Well, no valid username there, right? So what about this:

try{
$getMail = $dbh->prepare("SELECT EmailAddress FROM users WHERE username = :username");
$getMail->bindParam(':username', $username);
$getMail->execute();
$rowMail = $getMail->fetch();
$email = $rowMail['emailaddress'];
}
catch( PDOException $Exception ) {
echo 'Authentication Failed';
}

Can't test it right now, but it should be something around this lines...