trying to remove SQL injection attack vulunerablities

dr-matt-smith · Mar 24, 2019 · e09a4f4 · e09a4f4
1 parent dfef72d
commit e09a4f4
Show file tree

Hide file tree

Showing 6 changed files with 135 additions and 8 deletions.
diff --git a/composer.json b/composer.json
@@ -31,7 +31,8 @@
     },
     "autoload-dev": {
         "psr-4": {
-            "Mattsmithdev\\PdoCrudRepoTest\\": "tests"
+            "Mattsmithdev\\PdoCrudRepoTest\\": "tests",
+            "Tudublin\\":"src"
         }
     },
     "scripts": {

diff --git a/config/db.php b/config/db.php
@@ -0,0 +1,6 @@
+<?php
+
+define('DB_HOST', 'localhost:3306');
+define('DB_USER', 'root');
+define('DB_PASS', 'passpass');
+define('DB_NAME', 'evote');
diff --git a/public/index.php b/public/index.php
@@ -0,0 +1,26 @@
+<?php
+require_once __DIR__ . '/../config/db.php';
+require_once __DIR__ . '/../vendor/autoload.php';
+
+use Tudublin\MovieRepository;
+
+// for Car DB actions
+$movieRepository = new MovieRepository();
+
+//$movieRepository->delete(2);
+//$movies = $movieRepository->searchByColumn('title', 'jaws');
+//
+//
+//$movie = $movieRepository->getOneById(3);
+//$movie->setTitle('lskdjflksdjflds');
+//$movieRepository->update($movie);
+
+$m = new \Tudublin\Movie();
+$m->setTitle('pop');
+$m->setPrice(8.01);
+$movieRepository->create($m);
+
+$movies = $movieRepository->getAll();
+
+var_dump($movies);
+
diff --git a/src/DatabaseTableRepository.php b/src/DatabaseTableRepository.php
@@ -113,7 +113,8 @@ public function getAll()
         $db = new DatabaseManager();
         $connection = $db->getDbh();
 
-        $sql = 'SELECT * from ' . $this->tableName;
+        $sql = 'SELECT * from :table';
+        $sql = str_replace(':table', $this->tableName, $sql);
 
         $statement = $connection->prepare($sql);
         $statement->setFetchMode(\PDO::FETCH_CLASS, $this->classNameForDbRecords);
@@ -128,7 +129,10 @@ public function getOneById($id)
         $db = new DatabaseManager();
         $connection = $db->getDbh();
 
-        $statement = $connection->prepare('SELECT * from ' . $this->tableName . ' WHERE id=:id');
+        $sql = 'SELECT * from :table WHERE id=:id';
+        $sql = str_replace(':table', $this->tableName, $sql);
+
+        $statement = $connection->prepare($sql);
         $statement->bindParam(':id', $id, \PDO::PARAM_INT);
         $statement->setFetchMode(\PDO::FETCH_CLASS, $this->classNameForDbRecords);
         $statement->execute();
@@ -153,22 +157,34 @@ public function delete($id)
         $db = new DatabaseManager();
         $connection = $db->getDbh();
 
-        $statement = $connection->prepare('DELETE from ' . $this->tableName . ' WHERE id=:id');
+        $sql = 'DELETE from :table WHERE id=:id';
+        $sql = str_replace(':table', $this->tableName, $sql);
+
+        $statement = $connection->prepare($sql);
+//        $statement->bindParam(':table',  $this->tableName);
         $statement->bindParam(':id', $id, \PDO::PARAM_INT);
+
         $queryWasSuccessful = $statement->execute();
         return $queryWasSuccessful;
     }
 
 
     public function searchByColumn($columnName, $searchText)
     {
+        $columnName = filter_var($columnName, FILTER_SANITIZE_STRING);
+
         $db = new DatabaseManager();
         $connection = $db->getDbh();
 
         // wrap wildcard '%' around the serach text for the SQL query
         $searchText = '%' . $searchText . '%';
 
-        $statement = $connection->prepare('SELECT * from ' . $this->tableName . ' WHERE ' . $columnName . ' LIKE :searchText');
+        $sql = 'SELECT * from :table WHERE :column LIKE :searchText';
+        $sql = str_replace(':table', $this->tableName, $sql);
+        $sql = str_replace(':column', $columnName, $sql);
+
+        $statement = $connection->prepare($sql);
+//        $statement->bindParam(':column', $columnName, \PDO::PARAM_STR);
         $statement->bindParam(':searchText', $searchText, \PDO::PARAM_STR);
         $statement->setFetchMode(\PDO::FETCH_CLASS, $this->classNameForDbRecords);
         $statement->execute();
@@ -195,7 +211,12 @@ public function create($object)
         $insertFieldList = DatatbaseUtility::fieldListToInsertString($fields);
         $valuesFieldList = DatatbaseUtility::fieldListToValuesString($fields);
 
-        $statement = $connection->prepare('INSERT into '. $this->tableName . ' ' . $insertFieldList . $valuesFieldList);
+        $sql = 'INSERT into :table :insertFieldList :valuesFieldList';
+        $sql = str_replace(':table', $this->tableName, $sql);
+        $sql = str_replace(':insertFieldList', $insertFieldList, $sql);
+        $sql = str_replace(':valuesFieldList', $valuesFieldList, $sql);
+
+        $statement = $connection->prepare($sql);
         $statement->execute($objectAsArrayForSqlInsert);
 
         $queryWasSuccessful = ($statement->rowCount() > 0);
@@ -209,7 +230,7 @@ public function create($object)
 
     /**
      * insert new record into the DB table
-     * returns new record ID if insertation was successful, otherwise -1
+     * returns new record ID if insertion was successful, otherwise -1
      *
      * @param $object
      *
@@ -226,7 +247,10 @@ public function update($object)
         $fields = array_keys($objectAsArrayForSqlInsert);
         $updateFieldList = DatatbaseUtility::fieldListToUpdateString($fields);
 
-        $sql = 'UPDATE '. $this->tableName . ' SET ' . $updateFieldList  . ' WHERE id=:id';
+        $sql = 'UPDATE :table SET :updateFieldList WHERE id=:id';
+        $sql = str_replace(':table', $this->tableName, $sql);
+        $sql = str_replace(':updateFieldList', $updateFieldList, $sql);
+
         $statement = $connection->prepare($sql);
 
         // add 'id' to parameters array

diff --git a/src/Movie.php b/src/Movie.php
@@ -0,0 +1,61 @@
+<?php
+namespace Tudublin;
+
+
+class Movie
+{
+    private $id;
+    private $title;
+    private $price;
+
+    /**
+     * @return mixed
+     */
+    public function getId()
+    {
+        return $this->id;
+    }
+
+    /**
+     * @param mixed $id
+     */
+    public function setId($id)
+    {
+        $this->id = $id;
+    }
+
+    /**
+     * @return mixed
+     */
+    public function getTitle()
+    {
+        return $this->title;
+    }
+
+    /**
+     * @param mixed $title
+     */
+    public function setTitle($title)
+    {
+        $this->title = $title;
+    }
+
+    /**
+     * @return mixed
+     */
+    public function getPrice()
+    {
+        return $this->price;
+    }
+
+    /**
+     * @param mixed $price
+     */
+    public function setPrice($price)
+    {
+        $this->price = $price;
+    }
+
+
+
+}
diff --git a/src/MovieRepository.php b/src/MovieRepository.php
@@ -0,0 +1,9 @@
+<?php
+namespace Tudublin;
+
+use Mattsmithdev\PdoCrudRepo\DatabaseTableRepository;
+
+class MovieRepository extends DatabaseTableRepository
+{
+
+}