<<< Date Index >>>     <<< Thread Index >>>

Re: php create_function commond injection vulnerability



On Thu, 25 Sep 2008, lmfao@xxxxxxxxxxx wrote:

Are you kidding ?

As the PHP manual said "if you use double quotes there will be a need to escape the 
variable names".

In your example you use a function with double quotes, without escaping the 
variable $sort_by, so
this is not a PHP vulnerability, but a development one.

For this time, don't blame PHP, blame developers.
It's like if I was using mysql_query() without escaping user's inputs...an sql 
injection, not a PHP vuln ;)

To be fair, this kind of api is obviously a disaster waiting to happen.

Use an array to express an array of arguments? No, we'll just use concatenated strings again, that never caused any problems with sql... I wonder why all other languages have that strange 'prepared statements' format, and they never get the sql injection bugs. It's unfair!

Anyone up for a bet when PHP will add some more 'magic_quotes' to fix this mistake?