Skip to content

Commit a80ab8e

Browse files
DeFiTONDeFiTON
committed
Use prepared statements and add SQL injection test
1 parent 62c20a2 commit a80ab8e

File tree

3 files changed

+131
-52
lines changed

3 files changed

+131
-52
lines changed

‎_0xpay_postback.php‎

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,24 +7,45 @@
77

88
include 'botdata.php';
99

10-
include "global.php";
11-
$link = mysqli_connect($hostName, $userName, $password, $databaseName) or die ("Error connect to database");
12-
mysqli_set_charset($link, "utf8");
10+
include "global.php";
11+
$link = mysqli_connect($hostName, $userName, $password, $databaseName);
12+
if (!$link) {
13+
error_log('DB connection error: ' . mysqli_connect_error());
14+
exit();
15+
}
16+
mysqli_set_charset($link, "utf8");
1317

1418
include 'func_gen.php';
1519

1620
if($data['status'] == "Done"){
17-
$chat_id = $data['meta'];
18-
$addedSum = $data['amount'];
19-
20-
$str2select = "SELECT * FROM `users` WHERE `chatid`='$chat_id'";
21-
$result = mysqli_query($link, $str2select);
22-
$row = @mysqli_fetch_object($result);
23-
24-
$newbalance = $row->tgr_bep20 + $addedSum;
25-
26-
$str2upd = "UPDATE `users` SET `tgr_bep20`='$newbalance' WHERE `chatid`='$chat_id'";
27-
mysqli_query($link, $str2upd);
21+
$chat_id = intval($data['meta']);
22+
$addedSum = floatval($data['amount']);
23+
24+
$stmtSel = $link->prepare("SELECT * FROM `users` WHERE `chatid` = ?");
25+
if ($stmtSel === false) {
26+
error_log('Prepare failed: ' . $link->error);
27+
exit();
28+
}
29+
$stmtSel->bind_param('i', $chat_id);
30+
if (!$stmtSel->execute()) {
31+
error_log('SQL Error: ' . $stmtSel->error);
32+
}
33+
$result = $stmtSel->get_result();
34+
$row = @mysqli_fetch_object($result);
35+
$stmtSel->close();
36+
37+
$newbalance = $row->tgr_bep20 + $addedSum;
38+
39+
$stmtUpd = $link->prepare("UPDATE `users` SET `tgr_bep20` = ? WHERE `chatid` = ?");
40+
if ($stmtUpd === false) {
41+
error_log('Prepare failed: ' . $link->error);
42+
exit();
43+
}
44+
$stmtUpd->bind_param('di', $newbalance, $chat_id);
45+
if (!$stmtUpd->execute()) {
46+
error_log('SQL Error: ' . $stmtUpd->error);
47+
}
48+
$stmtUpd->close();
2849

2950
saveTransaction($addedSum, "TGR", "BEP20", "add", 0);
3051

‎tests/SqlInjectionTest.php‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?php
2+
try {
3+
$db = new PDO('sqlite::memory:');
4+
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
5+
$db->exec("CREATE TABLE users (id INTEGER PRIMARY KEY, username TEXT)");
6+
7+
$stmt = $db->prepare("INSERT INTO users(username) VALUES (?)");
8+
$malicious = "test'); DROP TABLE users; --";
9+
$stmt->execute([$malicious]);
10+
11+
$row = $db->query("SELECT username FROM users WHERE id = 1")->fetch(PDO::FETCH_ASSOC);
12+
if ($row['username'] === $malicious) {
13+
echo "Injection prevented\n";
14+
} else {
15+
echo "Injection occurred\n";
16+
exit(1);
17+
}
18+
19+
$tables = $db->query("SELECT name FROM sqlite_master WHERE type='table' AND name='users'")->fetchAll();
20+
if (count($tables) !== 1) {
21+
echo "Table dropped\n";
22+
exit(1);
23+
}
24+
} catch (PDOException $e) {
25+
echo "DB Error: " . $e->getMessage() . "\n";
26+
exit(1);
27+
}
28+
?>

‎tgbot.php‎

Lines changed: 68 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,13 @@
1212
exit();
1313
}
1414

15-
include "global.php";
16-
$link = mysqli_connect($hostName, $userName, $password, $databaseName) or die ("Error connect to database");
17-
mysqli_set_charset($link, "utf8");
15+
include "global.php";
16+
$link = mysqli_connect($hostName, $userName, $password, $databaseName);
17+
if (!$link) {
18+
error_log('DB connection error: ' . mysqli_connect_error());
19+
exit();
20+
}
21+
mysqli_set_charset($link, 'utf8');
1822

1923
include 'botdata.php'; // keys etc.
2024
include 'func_gen.php';
@@ -26,41 +30,58 @@
2630

2731
#################################
2832

29-
if (isset($data['message']['chat']['id']))
30-
{
31-
$chat_id = $data['message']['chat']['id'];
32-
}
33-
elseif(isset($data['callback_query']['message']['chat']['id']))
34-
{
35-
$chat_id = $data['callback_query']['message']['chat']['id'];
36-
}
37-
elseif(isset($data['inline_query']['from']['id']))
38-
{
39-
$chat_id = $data['inline_query']['from']['id'];
40-
}
33+
if (isset($data['message']['chat']['id'])) {
34+
$chat_id = intval($data['message']['chat']['id']);
35+
} elseif (isset($data['callback_query']['message']['chat']['id'])) {
36+
$chat_id = intval($data['callback_query']['message']['chat']['id']);
37+
} elseif (isset($data['inline_query']['from']['id'])) {
38+
$chat_id = intval($data['inline_query']['from']['id']);
39+
}
4140

4241
// Register new user in DB
4342
if(isset($data['callback_query']['message']['chat']['username']) && $data['callback_query']['message']['chat']['username'] != ''){
44-
$fname = $data['callback_query']['message']['chat']['first_name'];
45-
$lname = $data['callback_query']['message']['chat']['last_name'];
46-
$uname = $data['callback_query']['message']['chat']['username'];
47-
} else{
48-
$fname = $data['message']['from']['first_name'];
49-
$lname = $data['message']['from']['last_name'];
50-
$uname = $data['message']['from']['username'];
51-
}
52-
$time = time();
53-
54-
if(empty($uname))$uname = 'undefined';
55-
56-
$str2select = "SELECT * FROM `users` WHERE `chatid`='$chat_id'";
57-
$result = mysqli_query($link, $str2select);
58-
if(mysqli_num_rows($result) == 0){
59-
$str2ins = "INSERT INTO `users` (`chatid`,`username`,`tgr_ton`,`tgr_bep20`,`ton_ton`,`tgr_ton_full`,`ton_ton_full`,`ref`,`phone`) VALUES ('$chat_id','$uname', '0', '0', '0', '0', '0', '0', '0')";
60-
mysqli_query($link, $str2ins);
61-
$result = mysqli_query($link, $str2select);
62-
}
63-
$row = @mysqli_fetch_object($result);
43+
$fname = $data['callback_query']['message']['chat']['first_name'];
44+
$lname = $data['callback_query']['message']['chat']['last_name'];
45+
$uname = $data['callback_query']['message']['chat']['username'];
46+
} else{
47+
$fname = $data['message']['from']['first_name'];
48+
$lname = $data['message']['from']['last_name'];
49+
$uname = $data['message']['from']['username'];
50+
}
51+
$time = time();
52+
53+
if (empty($uname)) {
54+
$uname = 'undefined';
55+
}
56+
$uname = trim(filter_var($uname, FILTER_SANITIZE_FULL_SPECIAL_CHARS));
57+
58+
$stmt = $link->prepare("SELECT * FROM `users` WHERE `chatid` = ?");
59+
if ($stmt === false) {
60+
error_log('Prepare failed: ' . $link->error);
61+
exit();
62+
}
63+
$stmt->bind_param('i', $chat_id);
64+
if (!$stmt->execute()) {
65+
error_log('SQL Error: ' . $stmt->error);
66+
}
67+
$result = $stmt->get_result();
68+
if (mysqli_num_rows($result) == 0) {
69+
$stmtIns = $link->prepare("INSERT INTO `users` (`chatid`,`username`,`tgr_ton`,`tgr_bep20`,`ton_ton`,`tgr_ton_full`,`ton_ton_full`,`ref`,`phone`) VALUES (?, ?, 0, 0, 0, 0, 0, 0, 0)");
70+
if ($stmtIns === false) {
71+
error_log('Prepare failed: ' . $link->error);
72+
exit();
73+
}
74+
$stmtIns->bind_param('is', $chat_id, $uname);
75+
if (!$stmtIns->execute()) {
76+
error_log('SQL Error: ' . $stmtIns->error);
77+
}
78+
$stmtIns->close();
79+
80+
$stmt->execute();
81+
$result = $stmt->get_result();
82+
}
83+
$row = @mysqli_fetch_object($result);
84+
$stmt->close();
6485

6586
// Register new user in DB
6687

@@ -511,9 +532,18 @@
511532
}
512533
}else{
513534

514-
$str5select = "SELECT `action` FROM `temp_sess` WHERE `chatid`='$chat_id' ORDER BY `rowid` DESC LIMIT 1";
515-
$result5 = mysqli_query($link, $str5select);
516-
$row5 = @mysqli_fetch_object($result5);
535+
$stmt5 = $link->prepare("SELECT `action` FROM `temp_sess` WHERE `chatid` = ? ORDER BY `rowid` DESC LIMIT 1");
536+
if ($stmt5 === false) {
537+
error_log('Prepare failed: ' . $link->error);
538+
} else {
539+
$stmt5->bind_param('i', $chat_id);
540+
if (!$stmt5->execute()) {
541+
error_log('SQL Error: ' . $stmt5->error);
542+
}
543+
$result5 = $stmt5->get_result();
544+
$row5 = @mysqli_fetch_object($result5);
545+
$stmt5->close();
546+
}
517547
// Wallet
518548
if(preg_match("/withdrawWallet\|/", $row5->action)){
519549
withdrawFundsWait4Sum($data, $row5);

0 commit comments

Comments
 (0)