in reply to Re: Re: Passing References to Subroutines
in thread Passing References to Subroutines
I don't have time right now to look through all your code. I'll spend some time on it later tonight, but for now a quick glance reveals what I consider a major problem. You have many SQL insert and update statements that use outside data, but you don't use placeholders. I haven't looked carefully enough to know for sure if you're vulnerable, but this is a prime candidate for SQL injection attacks.
Here's an example of one of your SQL inserts:
my $executeSQL = "INSERT INTO FDNMail (msgid,subject,sourceip, +sourcednsname,[from],[to],allheaders,preamble,body,receiveddate,attac +hmentdata, custnum,[X-AOLIP]) VALUES ('".$record->{"msgid"}."','" +.$record->{"subject"}."','".$record->{"sourceip"}."','".$record->{"so +urcednsname"}. "','".$record->{"from"}."','".$record-> +{"to"}."','".$record->{"allheaders"}."','".$record->{"preamble"}."',' +".$record->{"body"}. "','".$record->{"receiveddate"}." +','".$record->{"attachmentdata"}."','".$record->{"custnum"}."','".$re +cord->{"xaolip"}."')"; my $action = $tema1->prepare($executeSQL);
Besides being generally hard to read and somewhat messy, if any of the values from $record contain tainted data, you have a huge vulnerability. I would write that like this:
my %fields = ( msgid => $record->{msgid}, subject => $record->{subject}, sourceip => $record->{sourceip}, sourcednsname => $record->{sourcednsname}, '[from]' => $record->{from}, '[to]' => $record->{to}, allheaders => $record->{allheaders}, preamble => $record->{preamble}, body => $record->{body}, receiveddate => $record->{receiveddate}, attachmentdata => $record->{attachmentdata}, custnum => $record->{custnum}, '[X-AOLIP]' => $record->{xaolip}, ); my $sql = "INSERT" . " INTO FDNMail (" . join(",", keys %fields) . ")" . " VALUES (" . join(",", ('?') x keys %fields) . ")"; my $fdnmail_sth = $temal->prepare($sql); $fdnmail_sth->execute(values %fields);
This has several advantages.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Re: Re: Re: Passing References to Subroutines
by ketema (Scribe) on May 19, 2004 at 13:23 UTC | |
|
Re: Re: Re: Re: Passing References to Subroutines
by ketema (Scribe) on May 19, 2004 at 14:34 UTC | |
|
Re: Re: Re: Re: Passing References to Subroutines
by ketema (Scribe) on May 19, 2004 at 15:04 UTC | |
by andyf (Pilgrim) on May 19, 2004 at 15:24 UTC |