mrlan
/
LRR
3
0
Fork 2
Code Issues Pull Requests 7 Projects Releases Wiki Activity

Xuxuan #48

Merged
xuxuan merged 6 commits from Xuxuan into master 2022-11-08 15:24:36 +08:00
Conversation 3 Commits 6 Files Changed 5
5 changed files with 33 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Download.php
View File

@ -8,7 +8,7 @@ session_start();
// 修改这一行设置你的文件下载目录
// IMPORTANT: Do not delete the following conditional test
if (strpos($_GET['file'], "../") != false) { // 检查是否有 ../，防止用户构造路径，访问某个他不应该访问的目录
if (strpos($_GET['file'], "../") !== false) { // 检查是否有 ../，防止用户构造路径，访问某个他不应该访问的目录
mrlan marked this conversation as resolved
mrlan commented 2022-10-13 09:26:28 +08:00
Review

@xuxuan

我理解了。当 '../' 是在最左边位置时，strpos 返回 0， 而 0 != false 是不成立的， 所以不会 die("Sorry. Nothing to download.");

改正后，0 !== false 成立。

https://www.php.net/manual/en/function.strpos.php 中的Example#1， Example#2 说明了这个问题。

Hui

@xuxuan 我理解了。当 `'../'` 是在最左边位置时，strpos 返回 0， 而 `0 != false` 是不成立的， 所以不会 `die("Sorry. Nothing to download.")`; 改正后，`0 !== false` 成立。 https://www.php.net/manual/en/function.strpos.php 中的Example#1， Example#2 说明了这个问题。 Hui
die("Sorry. Nothing to download.");
}

4
Reset_password.php
View File

@ -8,8 +8,8 @@
include 'Header.php';
$token=$_GET['token'];
$email=$_GET['email'];
$token = htmlspecialchars($_GET['token']);
$email = htmlspecialchars($_GET['email']);
?>
<div class="row">

50
Script.php
View File

@ -248,7 +248,7 @@ if (!empty($_POST["frm_reset_password"])) {
// Password Update
$hashed_password = hash('sha512', $password);
$sql = "UPDATE users_table set HashPassword='$hashed_password' where User_ID=$userid;";
$sql = "UPDATE users_table set HashPassword='$hashed_password' where User_ID='$userid';";
mrlan commented 2022-10-13 09:39:09 +08:00
Review

@xuxuan

多谢，加上单引号的作用是啥？

Hui

@xuxuan 多谢，加上单引号的作用是啥？ Hui
xuxuan commented 2022-10-13 09:51:42 +08:00
Review

通过mysqli_real_escape_string防止sql注入的原因是其会将一些特殊符号转义，例如将输入的'转义为\',从而防止sql注入。拼接的变量没有被单引号或双引号包裹mysqli_real_escape_string也就失去了作用

通过mysqli_real_escape_string防止sql注入的原因是其会将一些特殊符号转义，例如将输入的'转义为\\',从而防止sql注入。拼接的变量没有被单引号或双引号包裹mysqli_real_escape_string也就失去了作用
mrlan commented 2022-10-25 17:10:44 +08:00
Review

@xuxuan

Thanks

如果对所有的SQL变量，先使用下面链接中的 check_input 函数（见“预防数据库攻击的正确做法”），可以预防SQL注入问题吗？

https://www.w3school.com.cn/php/func_mysql_real_escape_string.asp

Hui

@xuxuan Thanks 如果对所有的SQL变量，先使用下面链接中的 `check_input` 函数（见“预防数据库攻击的正确做法”），可以预防SQL注入问题吗？ https://www.w3school.com.cn/php/func_mysql_real_escape_string.asp Hui
xuxuan commented 2022-11-02 14:52:49 +08:00
Review

在数据库编码不为中文的情况下是可以的,除了对输入做check_input处理,对数据库中取出来的数据同样也要进行check_input

在数据库编码不为中文的情况下是可以的,除了对输入做check_input处理,对数据库中取出来的数据同样也要进行check_input
if ($con->query($sql) === TRUE) {
error_reporting(0);
@ -430,7 +430,7 @@ if (!empty($_POST["frm_uploadlab"])) {
$sql = "INSERT INTO `lab_reports_table`(`Course_ID`, `Posted_Date`, `Deadline`, `Instructions`,
`Title`, `Attachment_link_1`, `Attachment_link_2`, `Attachment_link_3`, `Attachment_link_4`,Marks,Type)
VALUES ('$course_id','$date','$deadline','$instructions','$title','$targetfile','$targetfile2','$targetfile3','$targetfile3',$marks,'$type')";
VALUES ('$course_id','$date','$deadline','$instructions','$title','$targetfile','$targetfile2','$targetfile3','$targetfile3','$marks','$type')";
if ($con->query($sql) === TRUE) {
@ -467,7 +467,7 @@ if (!empty($_POST["frm_submitlab"])) {
$date = date("Y-m-d H:i:s");
// GET UPLOADED FILES
$labName = mysqli_query($con, "SELECT * FROM `lab_reports_table` WHERE Lab_Report_ID=$lab_id");
$labName = mysqli_query($con, "SELECT * FROM `lab_reports_table` WHERE Lab_Report_ID='$lab_id'");
while ($row = mysqli_fetch_assoc($labName)) {
$lab_name = $row['Title'];
$_SESSION['Sub_Type'] = $row['Type']; // submission type, either Individual or Group
@ -571,13 +571,13 @@ if (!empty($_POST["frm_submitlab"])) {
$group_id = 0; // FIXME
}
$sql1 = "DELETE FROM lab_report_submissions where Lab_Report_ID=$lab_id and Student_id=$student_id and Course_Group_id=$group_id";
$sql1 = "DELETE FROM lab_report_submissions where Lab_Report_ID='$lab_id' and Student_id='$student_id' and Course_Group_id='$group_id'";
if ($con->query($sql1) === TRUE) {
}
$sql = "INSERT INTO `lab_report_submissions`(`Submission_Date`, `Lab_Report_ID`, `Student_id`,"
. " `Course_Group_id`, `Attachment1`, `Notes`, `Attachment2`, `Attachment3`, `Attachment4`, `Status`, `Title`,`Remarking_Reason`)"
. " VALUES ('$date',$lab_id,$student_id,$group_id,'$targetfile','$instructions','$targetfile2','$targetfile3','$targetfile4',"
. " VALUES ('$date','$lab_id','$student_id','$group_id','$targetfile','$instructions','$targetfile2','$targetfile3','$targetfile4',"
. "'Pending','$title','')";
if ($con->query($sql) === TRUE) {
@ -665,7 +665,7 @@ if (!empty($_GET["updatevisibility"])) {
$header = mysqli_real_escape_string($con, $_GET["header"]);
$labid = mysqli_real_escape_string($con, $_GET["labid"]);
$sql = "UPDATE `lab_report_submissions` SET `Visibility`='$status' WHERE Submission_ID=$id
$sql = "UPDATE `lab_report_submissions` SET `Visibility`='$status' WHERE Submission_ID='$id'
";
if ($con->query($sql) === TRUE) {
@ -681,13 +681,13 @@ if (!empty($_GET["updatevisibility"])) {
if (!empty($_GET["remarking"])) {
$id = mysqli_real_escape_string($con, $_GET["id"]);
$url = mysqli_real_escape_string($con, $_GET["url"]);
$id = htmlspecialchars(mysqli_real_escape_string($con, $_GET["id"]));
$url = htmlspecialchars(mysqli_real_escape_string($con, $_GET["url"]));
$status = mysqli_real_escape_string($con, $_GET["status"]);
$details = mysqli_real_escape_string($con, $_GET["details"]);
$status = htmlspecialchars(mysqli_real_escape_string($con, $_GET["status"]));
$details = htmlspecialchars(mysqli_real_escape_string($con, $_GET["details"]));
$sql = "UPDATE `lab_report_submissions` SET `Status`='Remarking',Remarking_Reason='$details' WHERE Submission_ID=$id
$sql = "UPDATE `lab_report_submissions` SET `Status`='Remarking',Remarking_Reason='$details' WHERE Submission_ID='$id'
";
if ($con->query($sql) === TRUE) {
@ -709,7 +709,7 @@ if (!empty($_GET["creategroup"])) {
$name = mysqli_real_escape_string($con, $_GET["name"]);
$sql = "INSERT INTO `course_groups_table`(`Group_Name`,
`Group_Leader`, `Course_id`) VALUES ('$name',$student_id,$id)";
`Group_Leader`, `Course_id`) VALUES ('$name','$student_id','$id')";
if ($con->query($sql) === TRUE) {
@ -719,7 +719,7 @@ if (!empty($_GET["creategroup"])) {
}
$sql = "INSERT INTO `course_group_members_table`( `Course_Group_id`, `Student_ID`, `Status`)
VALUES ($gid,$student_id,'Created')";
VALUES ('$gid','$student_id','Created')";
if ($con->query($sql) === TRUE) {
$_SESSION["info_ReMarking"] = "Course group Created";
header("Location: Course.php?url=" . $url);
@ -746,7 +746,7 @@ if (!empty($_GET["groupinvite"])) {
header("Location: Course.php?url=" . $url);
} else {
$sql = "INSERT INTO `course_group_members_table`( `Course_Group_id`, `Student_ID`, `Status`)
VALUES ($groupid,$student_id,'Invited')";
VALUES ('$groupid','$student_id','Invited')";
}
if ($con->query($sql) === TRUE) {
@ -800,10 +800,10 @@ if (!empty($_GET["acceptinvite"])) {
$groupid = mysqli_real_escape_string($con, $_GET["groupid"]);
if ($action == 1) {
$sql = "Update `course_group_members_table` set Status='Joined' where Course_Group_id =$groupid and student_id=$student_id
$sql = "Update `course_group_members_table` set Status='Joined' where Course_Group_id ='$groupid' and student_id='$student_id'
";
} else {
$sql = "Delete from `course_group_members_table` where Course_Group_id =$groupid and student_id=$student_id
$sql = "Delete from `course_group_members_table` where Course_Group_id ='$groupid' and student_id='$student_id'
";
}
@ -830,11 +830,11 @@ if (!empty($_GET["extenddeadline"])) {
$deadline = $date . " " . $time;
if ($type == 1) {
$sql = "UPDATE `lab_reports_table` SET `Deadline`='$deadline' WHERE Lab_Report_ID=$id";
$sql = "UPDATE `lab_reports_table` SET `Deadline`='$deadline' WHERE Lab_Report_ID='$id'";
} else {
$sql = "INSERT INTO `extended_deadlines_table`(`Student_ID`, "
. "`Lab_Report_ID`, `Extended_Deadline_Date`,"
. " `ReasonsForExtension`) VALUES ($stdid,$id,'$deadline','$reason')";
. " `ReasonsForExtension`) VALUES ('$stdid','$id','$deadline','$reason')";
}
if ($con->query($sql) === TRUE) {
@ -856,7 +856,7 @@ if (!empty($_GET["ignoreremarking"])) {
$subid = mysqli_real_escape_string($con, $_GET["subid"]);
$sql = "UPDATE lab_report_submissions SET Status='Marked' WHERE Submission_ID=$subid";
$sql = "UPDATE lab_report_submissions SET Status='Marked' WHERE Submission_ID='$subid'";
if ($con->query($sql) === TRUE) {
@ -874,7 +874,7 @@ if (!empty($_GET["assignTA"])) {
$id = mysqli_real_escape_string($con, $_GET["id"]);
$ta = mysqli_real_escape_string($con, $_GET["ta"]);
$sql = "INSERT INTO `course_ta`(`Course_ID`, `TA`) VALUES ($id,$ta)";
$sql = "INSERT INTO `course_ta`(`Course_ID`, `TA`) VALUES ('$id','$ta')";
if ($con->query($sql) === TRUE) {
@ -893,9 +893,9 @@ if (!empty($_GET["AcceptStudent"])) {
$rs = mysqli_real_escape_string($con, $_GET["rs"]);
if ($rs == "yes") {
$sql = "Update course_students_table set Status='Joined' Where ID=$id";
$sql = "Update course_students_table set Status='Joined' Where ID='$id'";
} else {
$sql = "Delete FROM course_students_table Where ID=$id";
$sql = "Delete FROM course_students_table Where ID='$id'";
}
if ($con->query($sql) === TRUE) {
@ -931,7 +931,7 @@ if (!empty($_GET["action"])) {
}
if ($action == "passchange" && $_SESSION['user_id'] == $uid) {
$sql = "UPDATE users_table set Password='$pass' where User_ID=$uid;";
$sql = "UPDATE users_table set Password='$pass' where User_ID='$uid';";
if ($con->query($sql) === TRUE) {
error_reporting(0);
echo "Password has been changed";
@ -945,7 +945,7 @@ if (!empty($_GET["action"])) {
}
if ($action == "statuschange" && $_SESSION['user_id'] == $uid && ($_SESSION['user_type'] == "Lecturer" || $_SESSION['user_type'] == "Admin")) {
$sql = "UPDATE users_table set Status='$status' where User_ID=$uid;";
$sql = "UPDATE users_table set Status='$status' where User_ID='$uid';";
if ($con->query($sql) === TRUE) {
$_SESSION["info_Admin_Users"] = $type . " user Status updated successfully ";
header("Location: Admin.php");
@ -1018,7 +1018,7 @@ INNER JOIN lab_reports_table on lab_reports_table.Lab_Report_ID=lab_report_submi
INNER JOIN users_table on users_table.Student_ID=lab_report_submissions.Student_id
WHERE lab_report_submissions.Lab_Report_ID=$lab";
WHERE lab_report_submissions.Lab_Report_ID='$lab'";
$export = mysqli_query($con, $select);

5
batch_insert.php
View File

@ -19,7 +19,7 @@ if (!$conn) {
}
//获得用户名数据
$source = $_POST['users'];
$source = mysqli_real_escape_string($conn,$_POST['users']);
//如有多个空格，删除剩一个空格
$source1 = preg_replace('/\s\s+/', ' ', $source);
@ -31,13 +31,12 @@ $source2 = trim($source1);
//根据空格拆分
$user = explode(' ', $source2);
//插入数据
for($index=0; $index < count($user); $index++) {
$result = mysqli_query($conn, "SELECT * FROM `students_data` WHERE Student_ID='$user[$index]'");
if (mysqli_num_rows($result) < 1) {
if (! mysqli_query($conn, "REPLACE INTO `students_data`(`Student_ID`, `Passport_Number`) VALUES('$user[$index]', '')" ) ) {
echo "SQL Error: " . $sql_stmt . "<br>" . mysqli_error($conn);
echo "SQL Error: " . $sql_stmt . "<br>" .htmlspecialchars(mysqli_error($conn));
} else {
echo "<p>Student number $user[$index] added.</p>";
}

6
recover_password.php
View File

@ -27,9 +27,9 @@ include 'Header.php';
<div class="panel-body">
<form method="post" action="Script.php">
<input type="hidden" name="frm_recover_password" value="true"/>
Student number <input type="text" name="sno" placeholder="Enter your student number" class="form-control" required="required" value="<?php echo $_SESSION['student_number']; ?>">
Student number <input type="text" name="sno" placeholder="Enter your student number" class="form-control" required="required" value="<?php echo htmlspecialchars($_SESSION['student_number']); ?>">
<br/>
Email <input type="text" name="email" placeholder="Enter your email address" class="form-control" required="required" value="<?php echo $_SESSION['user_email']; ?>">
Email <input type="text" name="email" placeholder="Enter your email address" class="form-control" required="required" value="<?php echo htmlspecialchars($_SESSION['user_email']); ?>">
<br/>
<input type="submit" class="btn-primary" value="Recover">
@ -38,7 +38,7 @@ include 'Header.php';
<?php
if(isset($_SESSION['info_recover_password'])) {
echo '<hr><div class="alert alert-danger" role="alert">'.$_SESSION['info_recover_password'].'</div>';
echo '<hr><div class="alert alert-danger" role="alert">'.htmlspecialchars($_SESSION['info_recover_password']).'</div>';
$_SESSION['info_recover_password']=null;
}