China Cold Dragon Blog www.hackerschina.org: Code Audit: PHP is_numeric function Hexadecimal bypass bug occurred security issues?

About 0x00
Domestic part of the CMS program has been useful to the Is_numberic function, we first look at the structure of this function
BOOL Is_numeric (mixed $var)
Returns TRUE if Var is a numeric and numeric string, otherwise FALSE is returned.

Whether the 0x01 function is safe
Let's look at an example to see if this function is safe .

= Is_numeric ($_get[' s '])? $_get [' s ']: 0 ; $sql = INSERT INTO Test (type) values ($s); ; //Is values ($s) not values (' $s ') mysql_query ($sql);

The above fragment program is to determine whether the parameter S is a number, is to return a number, not to return 0, and then brought into the database query. (This will not construct the SQL statement)
we convert ' 1 or 1 ' to the value of the ' s ' parameter for the 16 binary 0x31206f722031
after the program runs, we query the database to see, such as:

If you re-query the field of this table out, do not filter into another SQL statement, will cause 2 injections.
0x02 Summary
Try not to use this function, if you want to use this function, it is recommended to use the canonical SQL statement, conditional add single quotation marks, so that the 16 binary 0x31206f722031 will be displayed in the database. No 1 or 1 will appear.