1

If I have a session variable $_SESSION['username'], and usernames can only contain letters, numbers, underscores and hyphens, and I put it directly into SQL, is this vulnerable at all to injection?

$sessionUsername = $_SESSION['username'];
SELECT x FROM y WHERE z='$sessionUsername'
frosty
  • 2,741
  • 4
  • 32
  • 59
  • Just use placeholders so we can stop worrying about these silly questions: it Just Doesn't Matter. Now, maybe the real question: "Can a *request* modify $_SESSION directy?" which is "no", when using cookie-based sessions. However the *store* of sessions could potentially be compromised (but then you're likely already hosed) .. or some other code might not expect the session values to be plopped directly in SQL (which is more likely and could be exploited). But no need to make it a problem; because it isn't one with placeholders. – user2864740 Jul 03 '15 at 21:36
  • Depends. Session variables are controlled by your scripts, but then how are they set? Do they depend on any kind of user input? – jonbaldie Jul 03 '15 at 21:36
  • If you use prepared statements then you should be fine, as they prevent SQL injection – George Jul 03 '15 at 21:37
  • @user2864740 I'm not familiar with OOP, can I just use `mysqli_real_escape_string()`? – frosty Jul 03 '15 at 21:37
  • @frosty Nothing to do with "OOP" at all. See http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php - I recommend *not* using the old manual escape method. It's crufty and is effectively considered mal-practice in about every environment except PHP.. – user2864740 Jul 03 '15 at 21:37
  • @user2864740 sorry I thought there were two types, the traditional procedural style with mysqli and OOP – frosty Jul 03 '15 at 21:40
  • The procedural style for mysqli is really just a wrapper around the "OOP" calling conventions. For example, `$conn->prepare(..)` and `mysqli_prepare($conn, ..)` are equivalent as are `mysqli_bind_param($stmt, ..)` and `$stmt->bind_param(..)`. The styles can even be freely mixed in a program - although that would be uglier! – user2864740 Jul 03 '15 at 21:45
  • Switching to the OOP style is not related to using parameter binding. You can bind variables just find with the non-OO MySQLi interface. – halfer Jul 03 '15 at 21:55

1 Answers1

0

Session variables can be changed from outside, so yes that's a risk. There's several ways to overcome this risk, on thing is that you can use prepared statements which is recommended. Or you could use filter_var to sort out potential threads, but definitely prepared statements is recommended.

Example of prepared statements. Not tested but should be fine. 

<?php
$dataFromDb = array();

$conn = new mysqli('HOST', 'USER', 'PASS', 'DATABASE');
$query = "SELECT x FROM y WHERE z = ?";
if ($stmt = $conn->prepare($query)) {
    $stmt->bind_param('s', $_SESSION['username']);
    $stmt->execute();
    $result = $stmt->get_result();
    while ($results = $result->fetch_array(MYSQLI_ASSOC)) {
        $dataFromDb[] = $results;
    }
}
halfer
  • 19,471
  • 17
  • 87
  • 173
Jesper
  • 3,661
  • 2
  • 15
  • 23
  • "Session variables can be changed from outside" outside of where? –  Jul 03 '15 at 21:42
  • 2
    @Dagon Outside of PHP :) – user2864740 Jul 03 '15 at 21:42
  • 3
    only if you have access to the server, in which case its game over anyway –  Jul 03 '15 at 21:42
  • Well having access to the server and game over is not really the same, depends on wich account the hacker gets to, if it's not an account with sudo rights or such, then it's not necessary game over, and you will be able to find out before it's too late. – Jesper Jul 03 '15 at 21:48
  • if some one has write access to the session directory they will have write access your php - game over –  Jul 03 '15 at 21:55
  • @Dagon not necessarily, just think about memcached stored sessions. usually memcached is accessible via LAN and has zero authentication by default – sathia Jul 03 '15 at 22:32
  • @Dagon http://stackoverflow.com/questions/3224286/what-are-the-risks-of-php-sessions – Jesper Jul 03 '15 at 22:34