0

I have a class having functions in PHP.This file is on server...can i call any function from this file from url? i do not want to modify this file...i just know function name..here is function

class mClass {
function execute($q) {
    $result = mysql_query($q) or die(mysql_error()."<br />".$q);
    }
function getParams($var, $default = '')
{
    $tmpvar = $default;
    if ( isset($_REQUEST[$var]) ) $tmpvar = $_REQUEST[$var];
    return $tmpvar;
}
}

can i do like this?

 mydomain.com/myfile.php?execute('my query here')

?

7
  • Why not just do a PHP include statement at the top of the page, instantiate the class, then call the function? Source: php.net/manual/en/function.include.php EDIT: This is assuming the file is included on your local server, not located at any remote example.com.
    – BLaZuRE
    Commented Jun 4, 2013 at 9:50
  • 1
    You could, not like that, but you could. But security hole much?
    – George
    Commented Jun 4, 2013 at 9:51
  • 1
    Really, don't do this, ever. Commented Jun 4, 2013 at 9:52
  • eval("$_GET['data'];"); Commented Jun 4, 2013 at 9:52
  • Something like mydomain.com/myfile.php?execute('DROP TABLE users') seems like a big enough security hole, one to stay lightyears away from.
    – Arjan
    Commented Jun 4, 2013 at 9:52

2 Answers 2

5

In the interest of preventing anyone else from ever conceiving doing something like this I feel obliged to answer with "Don't do this!!!!!"

This is a horrendous security hole and a disaster waiting to happen. You might as well just hand over control of your server. Aside from which it gives detailed insight into how your system is designed (again providing unnecessary information to hackers). Furthermore, you have no guarantees as to when, how, in what order, with what arguments, under what circumstances the functions might be called, what will be the contents of the cookie variable used by function xxx. You are abdicating control of your system in a frightening manner.

Now let's look at your specific example. If I ever see a website that has ?execute(...) it's going to raise a red flag. Me, the hacker, thinks to myself, "surely not, nobody would possibly do something like that!" so I google that part of the URL and sure enough this stack overflow question comes up and I see that you are dumping the argument into a MYSQL Query. "Good lord, I don't even need to SQL-inject!"

So, being an evil person, I decide to drop this query in:

.php?execute('SELECT * FROM `information_schema`.`tables`')

Now I see the structure of your database, and look, there's a table called user_account_info! I wonder how I can use this information to extort you for millions of dollars...

I could try

.php?execute('SELECT * FROM user_account_information')

Or maybe

.php?execute('SELECT credit_card FROM user_account_information')

But really why stop there, I can really turn the screws with

UPDATE user_account_information SET vital_customer_information =
    ENCRYPT(vital_customer_information, my_key_which_you_will_never_crack);

Now, you want your vital customer information back? How about you deposit some money in my Cayman Islands bank account and then I'll think about it....

Even ignoring the security implications this is poor design. The whole point of encapsulation, information hiding, etc. is blown by having a user transparently calling functions in your code.

3
  • If any engine/extension/etc. actually included a way to do this, I would wonder why they were stupid enough to feel this was in any way a good idea. This is, of course, assuming we're talking about remote servers.
    – BLaZuRE
    Commented Jun 4, 2013 at 9:52
  • I know this is not good practice..but i want to know about...just to enhance my knowledge
    – user2244804
    Commented Jun 4, 2013 at 10:09
  • Last line of the answer is very pertinent. If you're going to do something like this, you might as well just set up phpmyadmin and give them accounts there. It formats the results nicely, so you don't have to code that. :)
    – Barmar
    Commented Jun 4, 2013 at 10:11
2

Everyone else is pointing out that you really shouldn't do this, and I agree. But if someone is putting a gun to your head, the way you would do it is with a URL like:

mydomain.com/myfile.php?sql=my%20query%20here

Then in PHP you would use $_GET['sql'] to get the query.

BTW, to all the people who warn about Bobby Tables -- haven't you heard of limiting GRANT permissions? When we run applications that only need to read, they use an account with only SELECT permission, not UPDATE or DELETE. A script like this one should definitely use an account with very limited permissions.

1
  • It's always a good idea to limit permissions to only the bare minimum, but it's not a good idea to rely on that for the entire security model. And that's basically what you're doing when you allow users to shoot random queries to your database.
    – Arjan
    Commented Jun 4, 2013 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.