Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115492
MIME-Version: 1.0
References: <CAFv4g+HRHrvCOTgpbVfCXj06De1kL+1+RwnGgq6tcyLNAtLfQA@mail.gmail.com>
 <CAFv4g+ErRYaGJKJRJm9qYvCMQzUgbJE_hYfhTn6CtSeZ9SKxNw@mail.gmail.com>
 <CAFv4g+FH2ntZz_fSKhoFDMmjaDVhs56oR7x4tE3F250CAZsNtg@mail.gmail.com>
 <CAJmy8YFT9UA8fGmfAh9vcKQA=uM8nuSnEeu4U2sdD1oxQq1YjQ@mail.gmail.com>
 <CAFv4g+Hzgsjr6W=HWaWi2C1Joxz8Jg3PGwQCL7beVZc2YpLuHA@mail.gmail.com> <CAC5V6ghz-kgKSsziWDOULa2UCsTE3pEz-EMUEaWhi+Pkpfq-9w@mail.gmail.com>
In-Reply-To: <CAC5V6ghz-kgKSsziWDOULa2UCsTE3pEz-EMUEaWhi+Pkpfq-9w@mail.gmail.com>
Date: Mon, 19 Jul 2021 15:19:07 +0100
Message-ID: <CAFv4g+H-DK_51QcawP_B2VEq=wN1A9kSNNx2YgpkbkOgVRsxzA@mail.gmail.com>
To: Guilliam Xavier <guilliam.xavier@gmail.com>
Cc: Hans Henrik Bergan <divinity76@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000006c800505c77a9f7e"
Subject: Re: [PHP-DEV] [RFC] [VOTE] is_literal
From: craig@craigfrancis.co.uk (Craig Francis)

--0000000000006c800505c77a9f7e
Content-Type: text/plain; charset="UTF-8"

On Mon, 19 Jul 2021 at 12:51, Guilliam Xavier <guilliam.xavier@gmail.com>
wrote:

> there was *indeed* an SQL injection vulnerability in that code.



Yep, you're right, there was an issue in there as well.

esc_like() also needs to use esc_sql() for the value to be added directly
to the SQL string.

By changing to $wpdb->prepare(), assuming a literal string for the $query
argument, then esc_sql() would have been used automatically (technically
escape_by_ref).

Shall we just put it down as another example of escaping going wrong, why
Parameterised Queries work, and how Taint Checking isn't really a solution
(as the value was escaped, ish).

And if you want another fun one, not that anyone should be using inline
JavaScript, but esc_js() doesen't escape single quotes:

$variable = '\' onmouseover=alert(1) a=\'';

$html = "<a href='#' onclick='alert( \"" . esc_js( $variable ) . "\"
);'>Link</a>";

https://developer.wordpress.com/themes/escaping/#javascript

Craig

--0000000000006c800505c77a9f7e--