Re: [libdbi-users] libdbi and SQL Injection

[Markus H. <mar...@mh...>]

 

Am 2014-01-09 18:49, schrieb Rick Robinson: 

> I am new to both DBs and this library. I am attempting to save a string and insert it into my MYSQL DB. 
> 
> An example of the data being read into the db is here: 
> 
> The name is Krolps, and title is everything after it: 
> Krolps %s Saints going down tonight!!!!! 
> 
> The title entry in the MYSQL DB is turned into 
> name, title 
> 
> Here is my small program below: 
> 
> void 
> website_pfile_phase_one (struct char_data *ch) 
> { 
> dbi_conn conn; 
> dbi_result result; 
> dbi_inst instance; 
> 
> dbi_initialize_r (NULL, &instance); 
> conn = dbi_conn_new_r ("mysql", instance); 
> 
> dbi_conn_set_option (conn, "host", "box"); 
> dbi_conn_set_option (conn, "username", "username"); 
> dbi_conn_set_option (conn, "password", "password"); 
> dbi_conn_set_option (conn, "dbname", "dnbname"); 
> dbi_conn_set_option (conn, "encoding", "UTF-8"); 
> 
> if (dbi_conn_connect (conn) < 0) 
> { 
> puts ("Could not connect. Please check the option settingsn"); 
> } 
> else 
> { 
> char sql_string[MAX_STRING_LENGTH], sql_columns[MAX_STRING_LENGTH]; 
> 
> sprintf (sql_columns, 
> "name, title"); 
> sprintf (sql_string, 
> "REPLACE into data (%s) VALUES ("%s", "%s")", 
> sql_columns, GET_NAME (ch), ch->player.title ? ch->player.title : "None") ); 
> 
> result = dbi_conn_queryf (conn, sql_string); 
> 
> if (result) 
> { 
> puts ("SUCCESS Website Data"); 
> } 
> dbi_result_free (result); 
> } 
> dbi_conn_close (conn); 
> puts ("END of website data"); 
> dbi_shutdown_r (instance); 
> } 
> 
> Any suggestions on what I am doing wrong? My guess is I need to chanfge dbi_conn_queryf to something else?

Hi,

if I understand you correctly, you attempt to insert a value containing
the string "%s Saints going down tonight!!!!!" using the libdbi function
dbi_conn_queryf(). Thing is, dbi_conn_queryf() is intended to make
dbi_conn_query() behave somewhat like sprintf() in that you can specify
a formatting string containing placeholders like "%s", followed by
parameters that are filled in. If you want to preserve the "%s"
literally, you either need to escape or quote the values properly, or
you should rather use dbi_conn_query() which sends the string parameter
to the db engine literally. You still need to watch out for proper
quoting and escaping as per the language specs of your db engine.

hope this helps
Markus

-- 
Markus Hoenicka
http://www.mhoenicka.de
AQ score 38