MySQL: UPDATE database with JQuery sortable new value

Question

I've got this:

foreach($_POST['pos'] as $value) {
   $new_value = "UPDATE users SET regnr='" . $value . "' 
   WHERE username='" . mysql_real_escape_string($_COOKIE['username']) . "'";
}

// Connect to database
$opendb = mysql_connect($dbhost, $dbuser, $dbpass) or die("Kunde inte ansluta till MySQL:<br>" . mysql_error());
mysql_select_db($dbname) or die("Kunde inte ansluta till databasen:<br>" . mysql_error());

mysql_query($new_value) or die(mysql_error());  

// Close database
mysql_close($opendb);

Information:

$_POST['pos'] holds a value from the database in a hidden input. This value I have choosen to split with str_split($r['regnr'], 6); into a JQuery sortable list. If I type echo $value; in the foreach loop I've got the new value (not splitted, as I want) from the JQuery sortable list. I need all values from the list, and I get it with echo. But if I use $value variable to UPDATE the database that it came from, it just updates with the last value from the JQuery sortable list.

Can someone solve that? :D

Nice SQL injection hole. This code allows any malicious user to change anything they want in the users table, including making themselves superusers/admins. — Marc B
– Marc B, Commented Mar 15, 2013 at 16:57
How? This code is just an example this far. Haven't been focused on secure it yet. — Treps
– Treps, Commented Mar 15, 2013 at 17:06
If the user changes the value of the cookie username, then a user could inject this value you-got-hacked'; DROP DATABASE; and poof no more database. Yes that's how serious SQL injection can get. Use the PDO library or the MySQLi library. — Thomas Potaire
– Thomas Potaire, Commented Mar 15, 2013 at 17:54
@Treps you don't add security later. You design something proper from the beginning. — TFennis
– TFennis, Commented Mar 15, 2013 at 19:19
Okay, I will look into that. But is there someone who can solve the actual question? :) — Treps
– Treps, Commented Mar 16, 2013 at 11:56

Treps · Accepted Answer · 2013-03-18 14:54:30Z

1

Here is the solution:

$str = '';

foreach($_POST['pos'] as $value) {
  $str = $str.$value;
}

// Connect to database
$opendb = mysql_connect($dbhost, $dbuser, $dbpass) or die(mysql_error());
mysql_select_db($dbname) or die(mysql_error());

$new_value = "UPDATE users SET regnr='" . $str . "' WHERE username='" . mysql_real_escape_string($_COOKIE['username']) . "'";
mysql_query($new_value) or die(mysql_error());

// Close database
mysql_close($opendb);

answered Mar 18, 2013 at 14:54

Treps

7983 gold badges13 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

MySQL: UPDATE database with JQuery sortable new value

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related