Ok, so I am home now.
The first thing I want to say is:
NEVER trust user input at all.
You never know what is actually being submitted to you by a visitor, whether from an HTML form/input, a URL, or any other possible way. You should
always validate "visitor supplied data", both for any "weird" characters and to overall make sure what is being submitted is in fact what it "should be".
In your script, your have:
PHP:
...
//First of all:
$ident = $_GET['tutorial'];
// Later in the script:
$query="SELECT * FROM tutorials WHERE id='$ident'";
...
That right there is directly taking the value of $_GET['tutorial'] (filename.php?tutorial=
value) and using it in a MySQL database query. This, at times, can be alright, although what if Magic Quotes GPC was disabled?
Well first let me explain what Magic Quotes GPC is. Magic Quotes GPC is a configuration option in PHP that auotmatically "escapes" all data being passed to scripts automatically with slashes ("\"). This allows for data being submitted to your script(s) to be "made safe", somewhat.
An example would be all single quotes, double quotes, back slashes, etc in a string being passed to your script would have slashes placed before them, effectivly escaping anything harmful. (To an extent..
That is with Magic Quotes GPC enabled/turned on in the PHP configuration file. With Magic Quotes GPC disabled/turned off, these slashes are
not added, which is the first way to secure your scripts to SQL injection.
A simple way to check if Magic Quotes GPC is enabled or not would be to use the PHP function get_magic_quotes_gpc(), which returns an integer (0 or 1) whether Magic Quotes GPc is enabled or not.
If you don't know whether or not Magic Quotes GPC is enabled or not, you could use this at the very top of all of your PHP pages/scripts.
http://us3.php.net/manual/en/function.get-magic-quotes-gpc.php#60828 said:
PHP:
<?php
if(!get_magic_quotes_gpc()){
function deepslash($v){
return (is_array($v)) ? array_map("deepslash", $v) : addslashes($v);
}
array_map("deepslash", $_POST);
array_map("deepslash", $_GET);
array_map("deepslash", $_COOKIE);
array_map("deepslash", $_REQUEST);
array_map("deepslash", $_GLOBALS);
array_map("deepslash", $_SERVER);
}
?>
If you use that on every page, almost 100% of everything you have will be "SQL Injection proof", since all harmful characters will be escaped automatically.
Another "layer of security" you might want to add would be using the function
mysql_real_escape_string, which makes a given string 99.99990029388009% safe to be passed to a MySQL database server.
All you need to do is pass each string you want to submit as a query to a MySQL server through the function:
PHP:
...
$query = "SELECT * FROM tutorials WHERE id='$ident'";
$query = mysql_real_escape_string($query);
$results = mysql_query($query);
...
If you pass everything about to be sent as a query with mysql_query() through that function, you have almost eliminated any possible threat of an SQL iInjection attack.
Here is an example right from the
PHP function documentation page:
PHP:
<?php
// Quote variable to make safe
function quote_smart($value)
{
// Stripslashes
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
// Quote if not integer
if (!is_numeric($value)) {
$value = "'" . mysql_real_escape_string($value) . "'";
}
return $value;
}
?>
If, with EVERY MySQL query, you pass the query through the function being defined here (Quote_smart()), you will be safe from SQL Injections.
PHP:
...
$query = "SELECT * FROM tutorials WHERE id='$ident'";
$query = quote_smart($query);
$results = mysql_query($query);
...
Well, I hope I have taught you at least something. Any questions you may have just ask me. I'm not going to secure your code for you, I'm going to hope you learned how from reading this, and will be able to do it yourself.
Adios,
-Nedren
... Thanks in advance
<{}` 
