Is putting a $_SESSION variable straight into SQL a security risk?

Question

If I have a session variable $_SESSION['username'], and usernames can only contain letters, numbers, underscores and hyphens, and I put it directly into SQL, is this vulnerable at all to injection?

$sessionUsername = $_SESSION['username'];
SELECT x FROM y WHERE z='$sessionUsername'

Just use placeholders so we can stop worrying about these silly questions: it Just Doesn't Matter. Now, maybe the real question: "Can a *request* modify $_SESSION directy?" which is "no", when using cookie-based sessions. However the *store* of sessions could potentially be compromised (but then you're likely already hosed) .. or some other code might not expect the session values to be plopped directly in SQL (which is more likely and could be exploited). But no need to make it a problem; because it isn't one with placeholders. — user2864740, Jul 03 '15 at 21:36
Depends. Session variables are controlled by your scripts, but then how are they set? Do they depend on any kind of user input? — jonbaldie, Jul 03 '15 at 21:36
If you use prepared statements then you should be fine, as they prevent SQL injection — George, Jul 03 '15 at 21:37
@user2864740 I'm not familiar with OOP, can I just use `mysqli_real_escape_string()`? — frosty, Jul 03 '15 at 21:37
@frosty Nothing to do with "OOP" at all. See http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php - I recommend *not* using the old manual escape method. It's crufty and is effectively considered mal-practice in about every environment except PHP.. — user2864740, Jul 03 '15 at 21:37
@user2864740 sorry I thought there were two types, the traditional procedural style with mysqli and OOP — frosty, Jul 03 '15 at 21:40
The procedural style for mysqli is really just a wrapper around the "OOP" calling conventions. For example, `$conn->prepare(..)` and `mysqli_prepare($conn, ..)` are equivalent as are `mysqli_bind_param($stmt, ..)` and `$stmt->bind_param(..)`. The styles can even be freely mixed in a program - although that would be uglier! — user2864740, Jul 03 '15 at 21:45
Switching to the OOP style is not related to using parameter binding. You can bind variables just find with the non-OO MySQLi interface. — halfer, Jul 03 '15 at 21:55

score 1 · Answer 1 · edited Jul 03 '15 at 21:57

Session variables can be changed from outside, so yes that's a risk. There's several ways to overcome this risk, on thing is that you can use prepared statements which is recommended. Or you could use filter_var to sort out potential threads, but definitely prepared statements is recommended.

Example of prepared statements. Not tested but should be fine.

<?php
$dataFromDb = array();

$conn = new mysqli('HOST', 'USER', 'PASS', 'DATABASE');
$query = "SELECT x FROM y WHERE z = ?";
if ($stmt = $conn->prepare($query)) {
    $stmt->bind_param('s', $_SESSION['username']);
    $stmt->execute();
    $result = $stmt->get_result();
    while ($results = $result->fetch_array(MYSQLI_ASSOC)) {
        $dataFromDb[] = $results;
    }
}

Is putting a $_SESSION variable straight into SQL a security risk?

1 Answers1

Related