-2

I have a complex database search page which allows users to select which fields are called from the database, which fields is he searching by and so on. After seeing the results he has the option to download an excel file including the results. This file will be created after he clicks on the download link (This way the searches are faster and you have to wait longer only when you want to download the file - usually thousands of results mach). For this to work I need to pass on the same query string to another php file which will create the excel file.

My code is as follows

$downloadLink = "<a href='excel.php?download=".$query."'>Download (.xlsx file)</a>";
echo $query;

Let's say that my $query variable contains the following:

SELECT `people_id` , `source`, `volunteer`, `last_name`, `first_name` FROM `people` WHERE `first_name` LIKE 'Jon%' ORDER BY `people_id`

when i echo out the data it shows correctly but when I click on the link it sends me to

http://localhost/projects/Adatbazis3/excel.php?download=SELECT%20`people_id`%20,%20`source`,%20`volunteer`,%20`last_name`,%20`first_name`%20FROM%20`people`%20WHERE%20`first_name`%20LIKE

  1. Is there a limit to the amount of characters that can be in a $_GET variable?
  2. Is there a problem in the code?
  3. What other solution might be possible?
4
  • 4
    (1) you should urlencode the query, (2) this is a first class SQL injection spot
    – MrTux
    Aug 19, 2014 at 13:11
  • this is extremely dangerous, should never pass querys in your URL - have you considered using POST?
    – Halfpint
    Aug 19, 2014 at 13:13
  • The page is protected from any unauthorized access. Also the search page allows you to access any kind of data from the table, I don't think is a risk in this situation.
    – Czoka
    Aug 19, 2014 at 13:17

3 Answers 3

1

First of all you should urlencode the $query when you are printing as html

$downloadLink = "<a href='excel.php?download=".urlencode($query)."'>Download (.xlsx file)</a>";

2nd of all there is a limit for the length of GET requests on the browser's end. As I remember it is around 2000 characters for Internet Explorer and around 8000 chars for proper browsers

As a 3rd thing I would like to express my opinion: You should never ever send mysql queries like this. It exposes a lots of security issues. Try sending the variable parts instead and build your query in the back end (make sure you properly sanitize your input)

1
  • I will consider creating a global mysql query builder, but for now the urlencode() function solves the problem. Main reason why i'm not doing this the fully secure way is because this database is on a local computer and only 2 people have access to this computer (me and a friend of mine) whom are working together on this project, so no security risk involved so far
    – Czoka
    Aug 19, 2014 at 14:37
0

First you should pass the result from the query and if you are passing in url. You should use url_encoded for passing and plz don't pass whole query in your url

1
  • urlencode() is the function that I will use, it solves the problem. Which was that I am used to single quotation marks in HTML which lead to closing the link accidentally with **'**Jon% ...
    – Czoka
    Aug 19, 2014 at 14:31
0

To pass secret stuff from one to the other PHP, use $_SESSION global array.

To expose any query to the browser like you are doing (besides the flaws with improper encoding) is way dangerous!

Assume, someone alters your query to "SELECT * from people" and captures the output - wouldn't it expose the entire "people" table to everyone?

Look at this link!

Edited:

The page is protected from any unauthorized access

If this would be true, would you bet your legs on that? Don't be silly, even authorized people are doing crime.

1
  • Not a bad idea, for now I'm staying with the urlencode() solution suggested in the other answers. For the future, I think the most secure way is to send only variables and to create a global MySQL query builder that processes it.
    – Czoka
    Aug 19, 2014 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.