Sql injection

He
ik heb een Script met steen papier schaar,
Jponsen heeft alleen een buq gevonden waardoor hij gewoon in 1x 70000 credits heeft.
weet iemand hoe je dat beveiligd?

mysql_real_escape_string om de php-variabelen in je query heenzetten

mysql_query("mysql_real_escape_string)
zo?

Bij bij alles wat je invult gewoon mysql_real_escape_string($variable); zetten.

Zie ook: http://nl2.php.net/mysql_real_escape_string

dat snap ik niet?

mysql_real_escape_string(SELECT * FROM tabel WHERE username=blablabla);

@mikeb wat jij nu doet klopt niet? haha

@smiegles het is wat Jponsen zegt:
mysql_real_escape_string($variable);

Zo moet het als je het niet snapt moet je het laten maken want dan snap je niets van php.. Nie boos bedoeld maar als je wilt dat we je hier helpen moet je effe het script hier neer zetten ..

dit is de code

[COLOR= #0000BB]<?php[/COLOR]
[URL="http://www.php.net/include"]include[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"boven.php"[/COLOR][COLOR= #007700]);[/COLOR]
?>
[COLOR= #0000BB]<?php[/COLOR]    
  
   [COLOR= #FF8000]/*
   
   WAT NUTTIGE INFO
   
   De getallen om te weten of je gewonnen, verloren of gelijkspel had.
   
   (0) = Verloren
   (1) = Gewonnen
   (2) = Gelijkspel
   
   De getallen van steen, papier en schaar.
   
   (0) = Steen
   (1) = Schaar
   (2) = Papier
   
   Als je echo spelen($jij, $computer); doet, krijg je de values terug van
   gewonnen, verloren of gelijkspel terug.
   Dit kan handig zijn als je het in de database wilt zetten.
   
   */[/COLOR]

        
    [COLOR= #007700]function[/COLOR] spelen[COLOR= #007700]([/COLOR][COLOR= #0000BB]$speler_1[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]$speler_2[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]$gewonnen[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/array"]array[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]1[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]2[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]0[/COLOR][COLOR= #007700])){[/COLOR]
        
            [URL="http://www.php.net/return"]return[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$speler_1[/COLOR] [COLOR= #007700]!=[/COLOR] [COLOR= #0000BB]$speler_2[/COLOR][COLOR= #007700]) ? ([/COLOR][COLOR= #0000BB]$gewonnen[/COLOR][COLOR= #007700][[/COLOR][COLOR= #0000BB]$speler_1[/COLOR][COLOR= #007700]] ==[/COLOR] [COLOR= #0000BB]$speler_2[/COLOR][COLOR= #007700]) ?[/COLOR] [COLOR= #0000BB]1[/COLOR] [COLOR= #007700]:[/COLOR] [COLOR= #0000BB]0[/COLOR] [COLOR= #007700]:[/COLOR] [COLOR= #0000BB]2[/COLOR] [COLOR= #007700];
            
    }[/COLOR]
   
   [URL="http://www.php.net/if"]if[/URL] [COLOR= #007700]([/COLOR][URL="http://www.php.net/isset"]isset[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]submit[/COLOR][COLOR= #007700]])){[/COLOR]
   
        [COLOR= #0000BB]$jij[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]keuze[/COLOR][COLOR= #007700]];[/COLOR]
        [COLOR= #0000BB]$computer[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/rand"]rand[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]0[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]2[/COLOR][COLOR= #007700]);[/COLOR]
   
        [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]<strong>[/COLOR][COLOR= #007700];[/COLOR]
        [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]De computer had [/COLOR][COLOR= #007700];[/COLOR]
        
        [URL="http://www.php.net/if"]if[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$computer[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #0000BB]0[/COLOR][COLOR= #007700]){[/COLOR]
            [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]steen[/COLOR][COLOR= #007700];
        }[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$computer[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #0000BB]1[/COLOR][COLOR= #007700]){[/COLOR]
            [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]schaar[/COLOR][COLOR= #007700];
        }[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$computer[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #0000BB]2[/COLOR][COLOR= #007700]){[/COLOR]
            [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]papier[/COLOR][COLOR= #007700];
   }[/COLOR]
  
   
   [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000] en jij had [/COLOR][COLOR= #007700];[/COLOR]
   
       [URL="http://www.php.net/if"]if[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$jij[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #0000BB]0[/COLOR][COLOR= #007700]){[/COLOR]
            [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]steen[/COLOR][COLOR= #007700];
       }[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$jij[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #0000BB]1[/COLOR][COLOR= #007700]){[/COLOR]
            [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]schaar[/COLOR][COLOR= #007700];
       }[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$jij[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #0000BB]2[/COLOR][COLOR= #007700]){[/COLOR]
            [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]papier[/COLOR][COLOR= #007700];
       }[/COLOR]
       
       [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]</strong>[/COLOR][COLOR= #007700];[/COLOR]
       [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]<br /><br />[/COLOR][COLOR= #007700];[/COLOR]
       
       [URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR]spelen[COLOR= #007700]([/COLOR][COLOR= #0000BB]$jij[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]$computer[/COLOR][COLOR= #007700]) ==[/COLOR] [COLOR= #0000BB]0[/COLOR][COLOR= #007700]){[/COLOR]
            [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]<span style="color: red;">Verloren</span>[/COLOR][COLOR= #007700];
   }[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL][COLOR= #007700]([/COLOR]spelen[COLOR= #007700]([/COLOR][COLOR= #0000BB]$jij[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]$computer[/COLOR][COLOR= #007700]) ==[/COLOR] [COLOR= #0000BB]1[/COLOR][COLOR= #007700]){[/COLOR]
           [COLOR= #0000BB]$queryToevoeg[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"SELECT * from users WHERE id="[/COLOR][COLOR= #007700].[/COLOR][URL="http://www.php.net/mysql_real_escape_string"]mysql_real_escape_string[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_SESSION[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]uid[/COLOR][COLOR= #007700]]).[/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700]);[/COLOR]
           [COLOR= #0000BB]$rowToevoeg[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_fetch_array"]mysql_fetch_array[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$queryToevoeg[/COLOR][COLOR= #007700]);[/COLOR]
           [COLOR= #0000BB]$creditshDB[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$rowToevoeg[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]credits[/COLOR][COLOR= #007700]];[/COLOR]
           [COLOR= #0000BB]$credituDB[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$creditshDB[/COLOR] [COLOR= #007700]+[/COLOR] [COLOR= #0000BB]10[/COLOR][COLOR= #007700];[/COLOR]
           [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"UPDATE users SET credits="[/COLOR][COLOR= #007700].[/COLOR][COLOR= #0000BB]$credituDB[/COLOR][COLOR= #007700].[/COLOR][COLOR= #DD0000]" WHERE id="[/COLOR][COLOR= #007700].[/COLOR][URL="http://www.php.net/mysql_real_escape_string"]mysql_real_escape_string[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_SESSION[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]uid[/COLOR][COLOR= #007700]]).[/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700]);[/COLOR]
         [URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000] <meta HTTP-EQUIV="REFRESH" content="0; url=winnendepage.php">[/COLOR][COLOR= #007700];
       }[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL][COLOR= #007700]([/COLOR]spelen[COLOR= #007700]([/COLOR][COLOR= #0000BB]$jij[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]$computer[/COLOR][COLOR= #007700]) ==[/COLOR] [COLOR= #0000BB]2[/COLOR][COLOR= #007700]){[/COLOR]
            [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]<span style="color: black;">Gelijkspel</span>[/COLOR][COLOR= #007700];
       }[/COLOR]
      
       [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]<br /><br />[/COLOR][COLOR= #007700];[/COLOR]
       [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]<a href="[/COLOR] [COLOR= #007700].[/COLOR] [COLOR= #0000BB]$_SERVER[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]PHP_SELF[/COLOR][COLOR= #007700]] .[/COLOR] [COLOR= #DD0000]">Speel nog eens!</a>[/COLOR][COLOR= #007700];
   
   }[/COLOR][URL="http://www.php.net/else"]else[/URL][COLOR= #007700]{[/COLOR]
   
?>

<form method="post" action="[COLOR= #0000BB]<?php[/COLOR] [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #0000BB]$_SERVER[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]PHP_SELF[/COLOR][COLOR= #007700]];[/COLOR] ?>">

<h3>Steen, papier, schaar!</h3>
<br />

Maak je keuze:
<br /><br />

<select name="keuze">
<option value="0">Steen</option>
<option value="1">Schaar</option>
<option value="2">Papier</option>
</select>

<br />

<input type="submit" name="submit" value="Ok!">

</form>

[COLOR= #0000BB]<?php[/COLOR]

     [COLOR= #007700]}[/COLOR]
     
?>

Mikeb schreef:

mysql_real_escape_string(SELECT * FROM tabel WHERE username=blablabla);

FAAAL

$Query = mysql_query("SELECT * FROM tabel WHERE username= ".mysql_real_escape_string($var)."");

ik faal harder hoorrr..

@shahiem
Haha idd..

@smiegles maakt niet uit alleen het staat zelfs gewoon in je script zelf duss.. En hiervoor is one2xs ook om te helpen he haha

je kan beter iets doen als

$gespeeld = spelen($jij, $computer);

en dan kijken of $gespeeld 0, 1 of 2 is.. ?

dat snap ik niet?

@sjoerd Waarom is dit beter?

misschien Captcha opzetten