Mysql injections about opencad-php

[phillf]

@justinfarmer14 Do we have details of where and when this is possible?

[isoadam]

There are many vulnerable queries littered throughout the source

As an example:
https://github.com/StormlightTech/openCAD-php/blob/development-stable/actions/api.php#L1015-L1023

[phillf]

Would it be worth writing a SQL library to handle queries now or going through and patching all of these and saving that library for later?

[isoadam]

I would personally suggest overhauling database interaction. Maybe consider an ORM?

I think reviewing interaction with the database will be important for securing the performance and scalability of the project.

My current understanding is that you authenticate with the database on nearly every request - this is not the greatest idea.
Consider complex application logic which may require multiple database transactions - authenticating with the database multiple times will slow the application times of the application, increasing response times - not the greatest idea for realtime applications and data.

I have not worked with PHP for a couple of years now - but it will be important to ensure that only one connection/authentication is made to the database per request.

If you wish to continue using the mysqli driver, consider exclusively using prepared statements, this should greatly reduce the chance of SQL injection vulnerable processes being present in the application.

[phillf]

(Leaving this for reference)
http://propelorm.org/

[isoadam]

Looks good!

[ItsAGeekThing]

I'm going to do a full security audit in the next few days

[ItsAGeekThing]

We should consider having the integration of an ORM as a separate report.