SQL Injection Attacks and Defense - 2009

Reviewing Code for SQL Injection • Chapter 3 103
// $_POST − an associative array of variables passed via the POST method
$variable = $_POST['name'];
// $HTTP_POST_VARS − an associative array of variables passed via the POST
// method, depreciated in PHP v4.1.0
$variable = $HTTP_POST_VARS['name'];
// $_REQUEST − an associative array that contains the contents of $_GET,
// $_POST & $_COOKIE
$variable = $_REQUEST['name'];
// $_COOKIE − an associative array of variables passed via HTTP Cookies
$variable = $_COOKIE['name'];
// $_SERVER − server and execution environment information
$variable = $_SERVER['name'];
// $HTTP_SERVER_VARS − server and execution environment information,
// depreciated in PHP v4.1.0.
$variable = $HTTP_SERVER_VARS['name']
PHP has a very well-known setting, register_globals, which you can configure from within
PHP’s configuration file (php.ini) to register the EGPCS (Environment, GET, POST, Cookie,
Server) variables as global variables. For example, if register_ globals is on, the URL “http://
www.victim.com/process_input.php?foo=input” will declare $foo as a global variable with
no code required (there are serious security issues with this setting, and as such it has been
deprecated and should always be turned off ). If register_ globals is enabled, user input can be
retrieved via the INPUT element and is referenced via the name attribute within an HTML
form. For example:
$variable = $foo;
In Java, the process is fairly similar. You use the request object to get the value that the
client passes to the Web server during an HTTP request. The request object takes the value
from the client’s Web browser and passes it to the server via an HTTP request. The class or
the interface name of the object request is HttpServletRequest. You write the object request as
javax.servlet.http.HttpServletRequest. Numerous methods are available for the request object.
We are interested in the following functions, which are used for processing user input:
■■
■■
■■
■■
■■
getParameter( ) Used to return the value of a requested given parameter
getParameterValues( ) Used to return all the values of a given parameter’s
request as an array
getQueryString( ) Used to return the query string from the request
getHeader( ) Used to return the value of the requested header
getHeaders( ) Used to return the values of the requested header as an enumeration
of string objects