JeevesBond — Sat, 08 Dec 2007 05:10:49 +0000

Good point calculator, you can also cast the value as an int:

<?php
$number1 = (int) mysql_real_escape_string($_POST['number1']; 
$number2 = (int) mysql_real_escape_string($_POST['number2']; 

/* then run the query */ 
$sql = \"UPDATE goods SET stock = $number1, WHERE item = $number2; 
?>

That'll make sure they're numerics. Both methods will work.

calculator — Thu, 06 Dec 2007 13:44:14 +0000

if the posted values can only be number I would add an extra layer of security by checking if the $_post are numeric using the built-in php is_numeric() function.

if(is_numeric($_POST['number1']) && is_numeric($_POST['number2'])){
$number1 = mysql_real_escape_string($_POST['number1']);
$number2 = mysql_real_escape_string($_POST['number2']);
}

/* then run the query */

$sql = "UPDATE goods SET stock = $number1, WHERE item = $number2;

I know it's not necessary, but I think it then becomes a coding practice.

As an additional comment, if you know what calues can be chosen, ie values from a drop down menu, use the switch/case to make sure that the value entered is valid.

And as a final comment - after that I shut up - read Chris Shiflett excellent Essential PHP Security book.

JeevesBond — Thu, 06 Dec 2007 07:49:18 +0000

pr0gramm3r writes wise words. Take heed. PHP can be rather insecure if used improperly.

pr0gr4mm3r — Thu, 06 Dec 2007 03:40:10 +0000

The syntax is technically correct, but you should never use $_GET or $_POST variables directly in queries.

If I was a malicious user, I could send whatever I want to that script. I could make $_POST['number2'] equal...
2; DROP TABLE goods;'
...which would drop that table. Simple yet devastating. There are plenty of other malicious strings that could be injected into a query.

Simple way to fix it: run all values you take from a user through the mysql_real_escape_string() function.

<?php
$number1 = mysql_real_escape_string($_POST['number1'];
$number2 = mysql_real_escape_string($_POST['number2'];

/* then run the query */
$sql = \"UPDATE goods SET stock = $number1, WHERE item = $number2;
?>