1

I've a webpage to a webinar with id 217, and to to verify if a user can watch the webinar, I use that function:

function user_verify($idlive, $register){
  require("connect.php");
  $query = "SELECT * FROM `users` WHERE idlive = 217 && register = '$register'";
  $result = mysqli_query($conn, $query);
  $user = mysqli_fetch_assoc($result);
  mysqli_close($conn);
  if(isset($user)){
    return 1;
  } else {
    return 0;
  }
}

If return 1, I call the function to access the webinar:

function login($register){
  require("connect.php");
  
  $data_hora_inscricao = date('d/m/y H:i:s');
  $query = "SELECT * FROM `users` WHERE register = '$register' && idlive = 217";
  $result = mysqli_query($conn, $query);
  $user = mysqli_fetch_assoc($result);
  mysqli_close($conn);
  
  if(isset($user)){
    
    $data = [
      'u_id' => $user['id'],
      'u_name' => $user['nome'],
      'u_email' => $user['email'],
      'u_level' => $user['level'],
      'u_time' => 0
    ];
    
    
    $dadosUserCookie = serialize($data);
    setcookie('d_user_217', $dadosUserCookie, time() + (86400 * 1), "/");
    
    return 1;
    
  } else {
    return 0;
  }
}

If it returns 1 (success), I set a cookie to request user data on other pages. It always worked well, until yesterday. I don't know what's going on, but my AWS Lightsail database shows me that this code is using 100% of database capacity. What I can do to solve this?

Bruno Leonardo
  • 58
  • 4
  • 3
    **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Aug 13 '21 at 12:35
  • 2
    It's possible someone found this vulnerability in your code and started abusing it. – Dharman Aug 13 '21 at 12:36
  • 2
    @Dharman: Yes, I thought the same. Not only are the two piece of code very similar, the cookie can be read and modified, and who knows what else could be done. This certainly doesn't look secure from any point of view. – KIKO Software Aug 13 '21 at 12:39
  • I get the user register into a mysqli_real_escape_string($conn, $_POST['register']); I know that is not enough, but with this the problem can continue? – Bruno Leonardo Aug 13 '21 at 13:11
  • 1
    What does that mean? You can't just use this function in a random place in your code and hope that magic will happen. That function should be done when building SQL, but there's a much easier solution: just bind all data separately using prepared statements. Why even bother with escpaing? – Dharman Aug 13 '21 at 13:13

0 Answers0