spaces/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

converted from standard mysqli to mysqli prepared statements for security against sql injection

Browse Source
This commit is contained in:
jashton
2025-04-01 15:03:01 -06:00
parent e8ac27b5d5
commit cec9091ee0
7 changed files with 190 additions and 175 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/account_functions.php
+69 -49
View File
@@ -3,32 +3,17 @@ require_once 'db_functions.php';
function user_id_exists($user_id)
{
$query = 'SELECT user_id FROM user WHERE user_id = ' . $user_id . ';';
$result = query_one_result($query);
$conn = get_connection();
$stmt = $conn->prepare('SELECT user_id FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$result = $stmt->get_result()->fetch_assoc();
if ($result == null)
return false;
return true;
}
function auth_level($user_id)
{
$query = 'SELECT role_id FROM user WHERE user_id = ' . $user_id . ';';
$result = query_one_result($query);
$role = $result['role_id'];
return $role;
}
function modify_self()
{
return -1;
}
function delete_self()
{
return -1;
}
function cookies($user, $time)
{
setcookie('user_id', $user['user_id'], $time);
@@ -79,8 +64,12 @@ function login_form($error_msg = '')
function login($username, $password, $stay_logged_in)
{
$password_hash = hash('sha256', $password);
$query = 'SELECT user_id, username, email, role_id, profile_picture FROM user WHERE username ="' . $username . '" AND password_hash = "' . $password_hash . '";';
$user = query_one_result($query);
$conn = get_connection();
$stmt = $conn->prepare('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE username = ? OR email = ? AND password_hash = ?');
$stmt->bind_param('sss', $username, $username, $password_hash);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null) {
$error_msg = '
@@ -101,8 +90,9 @@ function login($username, $password, $stay_logged_in)
// echo strlen($token);
setcookie('remember_user', $token, time() + 60 * 60 * 24 * 30, '/', '', true, true);
$stmt = 'INSERT INTO remember_user (token, user_id, remote_addr' . (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? ', http_forward' : '') . ') VALUES ("' . $token . '", ' . $user['user_id'] . ', "' . hash('sha256', $_SERVER['REMOTE_ADDR']) . '"' . (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? ', "' . hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) . '"' : '') . ');';
exec_statement($stmt, 1);
$stmt = $conn->prepare('INSERT INTO remember_user (token, user_id, remote_addr, http_forward) VALUES (?, ?, ?, ?)');
$stmt->bind_param('siss', $token, $user['user_id'], hash('sha256', $_SERVER['REMOTE_ADDR']), (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) : null));
$stmt->execute();
}
return true;
@@ -176,7 +166,7 @@ function create_user($username, $email, $password, $verify_password, $role_id, $
while (user_id_exists($id))
$id = rand(1000, 999999999);
if (!empty($upload)) {
if (!empty($upload['profile_picture']['tmp_name'])) {
$orig_size = getimagesize($upload['profile_picture']['tmp_name']);
$orig_width = $orig_size[0];
$orig_height = $orig_size[1];
@@ -187,8 +177,13 @@ function create_user($username, $email, $password, $verify_password, $role_id, $
$target = upload($upload['profile_picture'], $_ENV['PROFILE_IMAGES_FQ_PATH'], $id);
}
$stmt = 'INSERT INTO user (user_id, username, email, password_hash, role_id' . (!empty($target) ? ', profile_picture' : '') . ') VALUES (' . $id . ', "' . $username . '", "' . $email . '", "' . $password_hash . '", ' . $role_id . (!empty($target) ? ', "' . $target . '"' : '') . ');';
exec_statement($stmt, 0);
$conn = get_connection();
$stmt = $conn->prepare('INSERT INTO user (user_id, username, email, password_hash, role_id, profile_picture) VALUES (?, ?, ?, ?, ?, ?)');
$asdf = (isset($target) ? $target : null);
$stmt->bind_param('isssis', $id, $username, $email, $password_hash, $role_id, $asdf);
$stmt->execute();
return true;
}
function profile_cropper()
@@ -250,8 +245,10 @@ function reset_password($user_id, $new_password, $verify_new_password)
}
$password_hash = hash('sha256', $new_password);
$stmt = 'UPDATE user SET password_hash = "' . $password_hash . '" WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 0);
$conn = get_connection();
$stmt = $conn->prepare('UPDATE user SET password_hash = ? WHERE user_id = ?');
$stmt->bind_param('si', $password_hash, $user_id);
$stmt->execute();
}
function update_email_form()
@@ -290,8 +287,10 @@ function update_email($user_id, $new_email, $verify_new_email)
return $error_msg;
}
$stmt = 'UPDATE user SET email = "' . $new_email . '" WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 0);
$conn = get_connection();
$stmt = $conn->prepare('UPDATE user SET email = ? WHERE user_id = ?');
$stmt->bind_param('si', $new_email, $user_id);
$stmt->execute();
}
function update_username_form()
@@ -330,8 +329,13 @@ function update_username($user_id, $new_username, $verify_new_username)
return $error_msg;
}
$query = 'SELECT username FROM user WHERE username = "' . $new_username . '";';
if (query_one_result($query) != null) {
$conn = get_connection();
$stmt = $conn->prepare('SELECT username FROM user WHERE username = ?');
$stmt->bind_param('s', $new_username);
$stmt->execute();
$result = $stmt->get_result()->fetch_assoc();
if ($result != null) {
$error_msg = '
<div class="error">
Usernames is taken!
@@ -341,17 +345,18 @@ function update_username($user_id, $new_username, $verify_new_username)
return $error_msg;
}
$stmt = 'UPDATE user SET username = "' . $new_username . '" WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 0);
$stmt = $conn->prepare('UPDATE user SET username = ? WHERE user_id = ?');
$stmt->bind_param('si', $new_username, $user_id);
$stmt->execute();
}
function request_role_change_form()
{
$query = 'SELECT * FROM roles WHERE role_id <> 1;';
$results = query_one_or_more_results($query);
$conn = get_connection();
$result = $conn->query('SELECT * FROM roles WHERE role_id <> 1');
$roles = '<div class="checkboxes">';
while ($row = mysqli_fetch_array($results)) {
while ($row = $result->fetch_assoc()) {
$roles .= '
<label class="form_checkbox_container">' . $row['role'] . '
<input name="requested_role" value="' . $row['role_id'] . '" type="checkbox"' . ($row['role_id'] == $_COOKIE['role_id'] ? ' checked' : '') . '>
@@ -429,10 +434,15 @@ function delete_account($user_id, $password = null, $verify_password = null)
return $error_msg;
}
$conn = get_connection();
if ($password && $verify_password) {
$password_hash = hash('sha256', $password);
$query = 'SELECT user_id, profile_picture FROM user WHERE user_id = ' . $user_id . ' AND password_hash = "' . $password_hash . '";';
$user = query_one_result($query);
$stmt = $conn->prepare('SELECT user_id, profile_picture FROM user WHERE user_id = ? AND password_hash = ?');
$stmt->bind_param('is', $user_id, $password_hash);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null) {
$error_msg = '
@@ -445,15 +455,19 @@ function delete_account($user_id, $password = null, $verify_password = null)
}
// Hardcoded prevention of deleting the owner's profile picture
if ($user['profile_picture'] != '2025.jpg')
if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg')
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 1);
$stmt = $conn->prepare('DELETE FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
logout();
} else if ($_COOKIE['role_id'] < 3) {
$query = 'SELECT user_id, profile_picture FROM user WHERE user_id = ' . $user_id . ';';
$user = query_one_result($query);
} else if ($_COOKIE['role_id'] <= 2) {
$stmt = $conn->prepare('SELECT user_id, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user['user_id'] == 2025) {
$error_msg = '
@@ -466,11 +480,13 @@ function delete_account($user_id, $password = null, $verify_password = null)
}
// Hardcoded prevention of deleting the owner's profile picture
if ($user['profile_picture'] != '2025.jpg')
if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg')
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 1);
$stmt = $conn->prepare('DELETE FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
}
}
@@ -479,8 +495,12 @@ function user_view($user_id)
if (!isset($_COOKIE['role_id']) || ($_COOKIE['role_id'] > 2 && $_COOKIE['user_id'] != $user_id))
header('Location: articles.php');
$query = 'SELECT user_id, username, email, role_id, created_at, last_active, is_active, profile_picture FROM user WHERE user_id = ' . $user_id . ';';
$user = query_one_result($query);
$conn = get_connection();
$stmt = $conn->prepare('SELECT user_id, username, email, role_id, created_at, last_active, is_active, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null)
header('Location: articles.php');