index.php | searchcode

/web-security/assignment1/answer with fix/sqlinjection/index.php

https://bitbucket.org/mkjinesh/pcs · PHP · 57 lines · 52 code · 5 blank · 0 comment · 10 complexity · 9a1e38dcd581c066bde427f928466b70 MD5 · raw file


<?php

error_reporting(0);

define('ok',1);

$page = "home.php";

mysql_connect("localhost", "root", "amma") or die('Error');

mysql_select_db("task");

 

if (isset($_POST['submit'])) {

        $q = mysql_query("SELECT * FROM users WHERE login = '".$_POST['login']."' AND password = '".md5($_POST['pwd'])."'");

        if (mysql_num_rows($q) == 0) {

                echo '<h1>Wrong login or password!</h1>';

        } else {

                setcookie('auth', base64_encode($_POST['login'].'|'.$_POST['pwd']));

                header("Location: ./index.php");

        }

        die();

}

 

if (isset($_COOKIE['auth'])) {

        $auth = base64_decode($_COOKIE['auth']);

        list($login, $password) = explode('|', $auth);

        $q = mysql_query("SELECT * FROM users WHERE login = '".$login."' AND password = '".md5($password)."'");

        if (mysql_num_rows($q) != 0) {

                $r = mysql_fetch_assoc($q); 

                $q = mysql_query("SELECT * FROM ".$r['status']."_info") or die('Error');

                $r = mysql_fetch_assoc($q);

                extract($r);

                echo 'Hello, '.$login.'!<br>Your country: '.$country.'<br>City: '.$city.'<br>Phone number: '.$phone.'<br>Secret PIN-code: '.$pin.'<br>';

                echo '<br><a href="?page=home.php">home</a>';

                echo '<br><a href="?page=news.php">news</a>';

                echo '<br><a href="?page=download.php">download</a>';

 		echo '<br><a href="?page=users.php">Users</a><br><br>';	

	



                $whitelist = array('news.php', 'home.php', 'download.php','users.php');

                if (isset($_GET['page'])) {

                        if (in_array($_GET['page'], $whitelist))

                                $page = $_GET['page'];

                }

                include("./inc/".$page);

                echo "<br><br>Designed by Bithin";

                die();

        } else {

                setcookie('auth',"");

        }

}

?>

 

<html>

        <body>  

        <form method="post" action="index.php">

                Login:<br><input type="text" name="login" /><br>

                Password:<br><input type="text" name="pwd" /><br>

                <input type="submit" name="submit" value="Go" />

        </form>

        </body>

</html>

Alerts (17)

'error_reporting(0)' Disabling error reporting hides issues; log errors instead of suppressing them
2
'mysql_connect(' Deprecated mysql_* functions; use PDO or MySQLi for modern database access
5
'die(' Abrupt termination detected; use try-catch or custom error handlers for better control
5 16 25 42
'$_POST[' Unbounded request input detected; limit size (e.g., check Content-Length or use max input vars) to prevent memory exhaustion
8 9 13
'md5(' Weak hashing detected; use password_hash() with PASSWORD_DEFAULT for secure password storage
9 22
'mysql_query(' Potential SQL injection risk; use PDO or MySQLi with prepared statements
9
'extract(' Variable extraction risks pollution; use explicit assignments instead
27
'$_GET[' Unbounded request input detected; limit size (e.g., check Content-Length or use max input vars) to prevent memory exhaustion
36 37 38
'include(' Dynamic include detected; use static paths (e.g., include '/path/file.php') to prevent code injection
40