Well I think I found the problem
This query:
Code:
$check = odbc_exec($connect, "SELECT * FROM TB_User WHERE StrUserID = '".$user."'");
if (odbc_num_rows($check) > 0) {
$error[] = "Account with such username already exists please chose another one";
}
is ALWAYS executed(if "go" is set, but that's nothing to care about)
Now you may think "Oh well I espaced it already"(The $user variable), BUT in mssql the escape char of
is NOT a
.
It is another
!!!!!
This being said it should be obvious how it's been done:
Code:
SELECT * FROM TB_User WHERE StrUserID = '\'; evil query n shit here --';
So what do we have here?
'\'; evil query n shit here --';
' <--indicates start of the string. as set in the query
\'; evil query n shit here -- <-- This is the bad part now. The backslash you can see here is the one addslashes added to the string, but sadly, this doesn't escape the following ' . now the end of the query is marked with ; (because mssql thinks the string already ended) everything after it is a NEW query. So you could enter pretty much everything there
The last part of this string is "--". It marks the left chars of the original query as a comment.
This + MSSQL 2000 allows someone to start a shell
Solution?
You can see
Code:
if (@count($error) > 0) {
[...]
} else {
[...]
}
after this query
Just put the query in the else part and change it, so it looks like this:
Code:
$check = odbc_exec($connect, "SELECT * FROM TB_User WHERE StrUserID = '".$user."'");
if (odbc_num_rows($check) > 0) {
echo "Account with such username already exists please chose another one";
echo "</Body></HTML>"; //finish the HTML file so there it's valid
odbc_close($connect); //close the connection
die(); //Stop the script right now
}
This should prevent SQL Injection
I strongly suggest everyone who's using this site to change it asap
oh there are two more mistakes i noticed:
- If one of the fields is not set(user, password, etc) PHP will generate an error(not important, but shouldn't happen)
-The connection to the database is never closed
It should be closed, though
You can do this by adding
Code:
<?php @odbc_close($connect); ?>
After "</html>" at the bottom of the file
