Re: php create_function commond injection vulnerability

[lmfao@hotmail.com]

Are you kidding ?

As the PHP manual said "if you use double quotes there will be a need to escape the variable names".

In your example you use a function with double quotes, without escaping the variable $sort_by, so
this is not a PHP vulnerability, but a development one.

For this time, don't blame PHP, blame developers.
It's like if I was using mysql_query() without escaping user's inputs...an sql injection, not a PHP vuln ;)

[bzhbfzj3001@sneakemail.com]

On Thu, 25 Sep 2008, lmfao@hotmail.com wrote:

> Are you kidding ?
>
> As the PHP manual said "if you use double quotes there will be a need to escape the variable names".
>
> In your example you use a function with double quotes, without escaping the variable $sort_by, so
> this is not a PHP vulnerability, but a development one.
>
> For this time, don't blame PHP, blame developers.
> It's like if I was using mysql_query() without escaping user's inputs...an sql injection, not a PHP vuln ;)
>
To be fair, this kind of api is obviously a disaster waiting to happen.

Use an array to express an array of arguments? No, we'll just use
concatenated strings again, that never caused any problems with sql... I
wonder why all other languages have that strange 'prepared statements'
format, and they never get the sql injection bugs. It's unfair!

Anyone up for a bet when PHP will add some more 'magic_quotes' to fix
this mistake?

[mnapier@slis.indiana.edu]

On Mon, 29 Sep 2008, bzhbfzj3001@sneakemail.com wrote:

> On Thu, 25 Sep 2008, lmfao@hotmail.com wrote:
>
> > Are you kidding ?
> >
> > As the PHP manual said "if you use double quotes there will be a need to
> > escape the variable names".
> >
> > In your example you use a function with double quotes, without escaping the
> > variable $sort_by, so
> > this is not a PHP vulnerability, but a development one.
> >
> > For this time, don't blame PHP, blame developers.
> > It's like if I was using mysql_query() without escaping user's inputs...an
> > sql injection, not a PHP vuln ;)
> >
> To be fair, this kind of api is obviously a disaster waiting to happen.
>
> Use an array to express an array of arguments? No, we'll just use concatenated
> strings again, that never caused any problems with sql... I wonder why all
> other languages have that strange 'prepared statements' format, and they never
> get the sql injection bugs. It's unfair!

you mean like pg_prepare and friends?
http://us2.php.net/manual/en/function.pg-prepare.php

>
> Anyone up for a bet when PHP will add some more 'magic_quotes' to fix this
> mistake?
>

-----------------------------------------
Mark E. Napier
Director of Information Technology
School of Library and Information Science
Indiana University