[Turbosport]

Originally Posted by andrefedalto

this part of the script is only accessible by the forum administrators, so why would an admin inject sql codes?

As a fellow coder I am not knocking the hack, in fact I really like it and it was exactly what I was looking for!

But its important that we as a community look out for and fix any security flaw we find, no matter how insignificant.

My admins are fully trusted, I run hourly snapshots of my database, so I like you probably have nothing to worry about, however there are others out there who are less fortunate. Maybe they have opened it up to thier Moderators and on a busy site this could end up being a few people.

The other worry is that someone will come along and reuse the code somewhere less secure not fully understanding the security issues.


An Admin on my site caused an SQL error by placing an apostrophy in the description field i.e. Dave's picture.

On examination it was a classic SQL injection hole.

I did a quick fix to stop this happening, but I intend to rewrite it to use one of the core VB functions for coverting strings to SQL safe, that way when VB find any other injection type issues and fix them the fix will be reflected in this hack.

Anyway if your interested here is my quick fix:

	$factv = addslashes(htmlspecialchars($_POST["bact"], ENT_QUOTES));
	$fdesc = addslashes(htmlspecialchars($_POST["balt"], ENT_QUOTES));

then the query:

	$db->query_write("INSERT INTO " . TABLE_PREFIX . "brotator (id, name, alt, active) VALUES ('', '$fname', '$fdesc', '$factv')");

I changed the other query further down using the same method.



I also added a little check before the query, for the odd occasion that theres an error in uploading the file:

	move_uploaded_file($ftemp, $dir.$fname);


if (file_exists($_SERVER['DOCUMENT_ROOT']."C:/SITES/TSWEB/BBS/images/banners/"."$fname")){

	$db->query_write("INSERT INTO " . TABLE_PREFIX . "brotator (id, name, alt, active) VALUES ('', '$fname', '$fdesc', '$factv')");
	print_cp_message($vbphrase['brotator_add_success'], "banner_rotator.php?do=add", "1");
}
else {	print_stop_message('brotator_uploaderror');}
endif;