0

I'm trying to understand how to securise my custom modules to avoid php insert into custom inputs and SQL injections in my db_query.

For inputs I'm using :

$form['custom'] = array(
      '#type' => 'textfield',
      '#title' => t('Custom),
      '#description' => t('Custom'),
      '#default_value' => '',
)

I tried to insert some PHP in the input and it actually run it whereas in the documentation it saiys that using form API should escape PHP by using check_plain and the safe example given is :

$form['also_safe'] = array(
  '#type' => 'select',
  '#default_value' => 0, // FAPI will pass through check_plain(),
  '#options' => node_get_types('names'),  // FAPI will sanitize the '#options' attribute with check_plain() for select boxes.
);

So what am I doing wrong ?

Concerning my SQL query I can't succeed to use as documented :

$result = db_query('SELECT $ FROM {custom} WHERE uid= :uid", array(':uid' => $value['in_array'])).

When calling a non object value I just get an error, so doing something like that works well but doesn't escape SQL injection :

$to_user_balance = db_query("SELECT * FROM {ubercart_funds_user_funds} WHERE uid=" . $value['in_array']));

I have to precise that I'm actually learning PHP and still didn't get what objects are. Because my aim is result and not capability, if somebody can explain me quickly how to securise my queries and inputs or drive me to a clear documentation.

I already know those documentation page and didn't help :

  • I suppose the syntax error in your db_query is an accident in the question? (You open with a single quote and close with a double one.) – Neograph734 Aug 15 '17 at 10:32
  • Ha ... Yeah ... It's an accident when I wrote it here. – Aporie Aug 15 '17 at 10:34
  • I just get an error What error do you get? – Neograph734 Aug 15 '17 at 10:37
2

It's a better idea to use db_select or other DB API functions, rather than trying to use db_query directly. You'd want to try something like:

 $to_user_balance = db_select('ubercart_funds_user_funds', 'ucfuf')
   ->fields('ucfuf')
   ->condition("uid", $value['in_array'], '=')
   ->execute()
   ->fetchAssoc();

For more, see https://api.drupal.org/api/drupal/includes%21database%21database.inc/function/db_select/7.x

And for overall DB API docs, see: Drupal.org DB API docs

  • I have read, I don't remember where, that db_query is such more efficient than db_select so I would prefer to use db_query. Also is it going to secure my queries (if I use db_select) because for me the problem will still be the same. Is it possible to select non objects datas ? – Aporie Aug 15 '17 at 8:23
  • @Aporie db_query is slightly faster, but not noticeable unless you start doing hundreds of queries in one request. If this is for fetching one or two results, db_select is safer and easier to read. – Neograph734 Aug 15 '17 at 10:34
  • My apologies guys, it seems that I was just forgetting the ->fetchAssoc; statement at the end of my db_query line. Everything seems to work correctly now. I still have some doubt about the possibility to insert php into the input of the form. I think I'm gonna update ubercart_funds module, because I'm working on it for a while and I hope it will pass drupal security requirements. – Aporie Aug 15 '17 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.