sql injection

Hi Ray

Hope you can help with this. I have a couple of pages that Jason helped me with originally and you helped me convert them to mysql_i. They use checkboxes to select email recipients. I'm told that the following lines leave the page vulnerable to an sql injection and hope there is an easy fix.

line 16: $WAFV_Errors .= WAValidateRQ(((isset($_POST["toEmail"]))?implode(", ",$_POST["toEmail"]):"") . "",false,2);

line 58: $Email->addBCC("".((isset($_POST["toEmail"]))?implode(", ",$_POST["toEmail"]):"") ."");

I've attached the page.

Many thank

Chris

Those lines couldn't possible lead to sql injection... they aren't even tied to any database sql at all.

Hi Ray

My apologies - wrong piece of code. It's in the page has the recipients recordset (in p.m.

Cheers

Chris

Try:

<?php

$rsRecips = new WA_MySQLi_RS("rsRecips",$connRIBIT_i,0);

$rsRecips->setQuery("SELECT CONCAT(rotarians.FirstName, ' ', rotarians.Surname)AS RecipName FROM rotarians WHERE rotarians.MemEmail IN (?) AND ClubID=? AND rotarians.status=0 ORDER BY rotarians.Surname");

$rsRecips->bindParam("sl", "".(isset($_POST['toEmail'])?$_POST['toEmail']:"-1") ."", "-1"); //p1

$rsRecips->bindParam("i", "".$_SESSION['ClubID'] ."", "-1"); //p2

$rsRecips->execute();

?>

Thanks Ray

The emails are sent, but each contains the following error message:

Notice: Array to string conversion in /home/sites/6b/5/5827535cbb/public_html/webassist/email/Rotary/members-email_body.php on line 6

Cheers

Chris

You shouldn't have changed the email code... just the recordset select statement. It shouldn't have any effect on your email code.

Line 58 should still be:
line 58: $Email->addBCC("".((isset($_POST["toEmail"]))?implode(", ",$_POST["toEmail"]):"") ."");

What is on members-email_body.php on line 6?

Hi Ray

Thanks. I haven't modified anything except the recordset.

Line 6 is from the new recordset code:

$rsRecips->bindParam("sl", "".(isset($_POST['toEmail'])?$_POST['toEmail']:"-1") ."", "-1"); //p1

Cheers

Chris

Try changing it to:


$rsRecips->bindParam("sl", (isset($_POST['toEmail'])?$_POST['toEmail']:"-1") , "-1"); //p1

Thanks Ray

That seems to have fixed it - no error on the emails.

Many thanks once again. See pm

Chris

Hi Ray

Something else has come up - see pm - is there a way round that? Client very concerned about GDPR.

Thanks

Chris