Comments on: Mongodb is vulnerable to SQL injection in PHP at least

By: witty

witty — Sun, 01 Jan 2012 16:15:34 +0000

well Andrew ,
But where can we find the code of the functions :
get_string()
and/or
get()

I can’t find them in the http://php.net/manual/ !

By: Andrew

Andrew — Tue, 05 Jul 2011 08:14:34 +0000

Nice catch! Just a suggestion though: never access $_GET directly. Always use a getter function, to which developer MUST specify the expected format. This approach solves most of the web application security problems.

For instance:
“username” => get(‘username’, GET_STRING, ‘/^[a-zA-Z0-9]+$/’)
(regex is optional)

Or:
“username” => get_string(‘username’, ‘/^[a-zA-Z0-9]+$/’)

Function get() should be the only way to access $_GET. You should even rename $_GET to make sure developers obey this convention.

My 0.02 EUR.

By: phil

phil — Mon, 21 Feb 2011 07:17:44 +0000

Your code would work but this would also work and means you don’t have to declare $username.

“username” => “{$_GET['username']}”

Either way as long as the input to mongodb remains a string your safe :)

By: Michael Grech

Michael Grech — Sun, 20 Feb 2011 07:48:22 +0000

Ah answered my own question. So you could do something like the following as well:

$username = $_GET['username']

than...

“username” => “$username"

By: Michael Grech

Michael Grech — Sun, 20 Feb 2011 07:39:21 +0000

Hey Phil, thanks for the post. Would this work as well than? Note the double quotes.

“username” => “$_GET['username'] “