Posting dropdown value to database

Richard Deeming

If the user can have any influence over the bruggernavn or id session variables, or the content of the navn column, then your queries will be vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query. PHP: SQL Injection - Manual[^] If they can influence the navn column, there's also a danger of a persisted cross-site scripting vulnerability, since you don't properly encode the output. Cross Site Scripting (XSS) | OWASP[^] Beyond that, you're setting the shoes column to the $getSko variable, which is the object returned by your mysql_query call. I suspect you wanted to set it to the $_POST['sko'] value instead.

"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

Member_15055508

You are correct. Should it be

mysql_query("UPDATE chat_brugere SET shoes='".$_POST['sko']."' WHERE id='".$_SESSION['id']."'");

instead of

					mysql\_query("UPDATE chat\_brugere SET shoes='".$getSko."' WHERE id='".$\_SESSION\['id'\]."'");

? Cause then it just posts the button value which is "Opdater!"

Richard Deeming

You'd need to move the <select> inside the <form> element, and use a different name for the button. But don't ignore the SQL Injection[^] vulnerability. It's a critical security vulnerability, which is so simple to exploit that even a 3 year old can exploit it[^]. It can be used to extract private data from your database, which can lead to massive fines[^]. Or it can be used to alter data in your database without your knowledge, which could have disastrous results. PHP: SQL Injection - Manual[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

Member_15055508

Thank you so much for your help.. I'm not worried about sql injection, cause its only me and 2 other people who has access to the site, since its protected through .htaccess, and will remain that way.. there is no sensitive information on the server either way :) I tried to move the select tag into the form, but now, the results from the database is shown outside the dropdown menu I have changed the name of the button to something else, and now, nothing is posted to the database when i hit the submit button.. Would you be willing to edit the script and post it here, if its not too big of a deal? i feel like i would understand the errors better, if i could compare the 2 codes, and see where i messed up

Richard Deeming

Something like this should work:

<?php
@session_start();
header('Content-Type: text/html; charset=ISO-8859-1');
include('includes/config.php');
?>
<link rel="stylesheet" type="text/css" href="css/chat.css" />
<div id="sidebar_header">Garderobe</div>
<div id="sidebar_content">
<form action="nygad.php" method="POST">
<p style="display: inline;">Skid i havet.</p><br /><br />
<select name="sko">
<?php
if(isset($_SESSION['logget_ind']) && $_SESSION['logget_ind'] == true) {
$brugernavn = mysql_real_escape_string($_SESSION['brugernavn']);
$getSko = mysql_query("SELECT `navn` FROM `chat_clothes` WHERE `ejer` = '$brugernavn' AND `type` = 'sko'");
while ($showSko = mysql_fetch_array($getSko)) {
$navn = htmlentities($showSko['navn']);
echo "<option value=\"$navn\">$navn</option><br />";
}
}
?>
</select>
<?php
if (isset($_POST['sko'])) {
$shoes = mysql_real_escape_string($_POST['sko']);
$id = mysql_real_escape_string($_SESSION['id']);
mysql_query("UPDATE chat_brugere SET shoes='$shoes' WHERE id='$id'");
echo 'sko er opdateret!';
}
?>
<p style="text-align:center;">
<input type="submit" name="btn" value="Opdater!" />
</p>
</form>
</div>

"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

Member_15055508

I tried the new script, and now it looks like it wants to post the selected value, but the problem now, is that none of the values from chat_clothes are appearing in the dropdown menu.. its just blank (even though i'm logged in as before) This is the script in the browser: [^] And this is the table chat_clothes: chat-clothes — ImgBB[^]

Richard Deeming

Check the the session variable logget_ind is set, and the value is equal to true. Also check that the session variable brugernavn is set, and matches one of the ejer values from your table.

"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

Member_15055508

OH MY GOD!! IT WORKS NOW!! :D:D I found the reason why it did not show the value in the dropdown menu.. The reason is that the value in the column in the table where it was searching for values, was "Røde Converse".. after i changed it to "Rode Converse", it now shows up.. So it was simply because the value contained a Ø (which is a letter in my language), and not anything wrong with the code you posted. Anyways, the script is working perfect now, after you fixed it.. Thank you SO much for your help.. This has been very enlightning for me.. before posting my question here, i tried posting about my problem at stackoverflow, and they just inactivated my question, since the code is outdated.. Thanks man! :D

jsc42

It is many years since I last used PHP, but shouldn't echo "<option value=\"$navn\">$navn</option><br />"; be something like echo "<option value=\"" . $navn . "\">" . $navn . "</option>"; to ensure that the value, rather than the variable name is concatenated. Plus the <br /> is not necessary as options are stacked anyway and the breaks will be saved for outside of the select rather than inside its options list.

Richard Deeming

PHP: Strings - Manual[^] If the string uses double-quotes, variables referenced within the string will be expanded. So the two options will produce the same output. :)

"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer