0

I write in PHP and want to execute a Query (postgresql). I have a class with

public $vulnName;
public $pluginID;
public $description;
public $scriptVersion;
public $riskFaktor;
public $solution;
public $output;
public $protocol;
public $port;
public $cve = [];
public $cvssBase;
public $cvss3Base;
public $cvss3temp;
public $ageofvuln;
public $exploit;
public $exploitInfo;
public $metasploitName;
public $hostArray = [];
public $date = "";
public $riskEvalution = "";
public $macaddress = "";
public $gepatcht = false;
public $inTodo = false;

I fill the variables with value from a report of vulnerabilitiescanner. I dumpt the query with :

var_dump("insert into vuln(vulnname, cvssv2, cvssv3, cvssv3t, output, description, age, exploitinfo,
riskfaktor, solution, pluginname, scriptversion, macadress, date, riskevalution, idcustomer, gepatchte, port, todo)
values ( '$tempVul',  '$tempcvssBase', '$tempcvss3Base', '$tempcvss3temp', '$tempoutput', '$tempDesc', '$tempageofvuln',
'$tempexploitInfo' , '$tempriskFaktor', '$tempsolution',  $tempPlug , '$tempScriptVersion', '$tempMAC', '$date',
'$tempriskEvalution', (select customerid from customer where name = '$tempCustomer'), FALSE, $port, $tempTodo) ON CONFLICT DO nothing;");

I think the string is too long (look at the picture). The result of the Query is false. But why ?

Thanks for any help

Vardump

srepper
  • 29
  • 3
  • 1
    _"Which practise is recommended ?"_ Instead of building queries with string concatenation, always use [**prepared statements**](https://secure.php.net/manual/en/pdo.prepare.php) with [**bound parameters**](https://secure.php.net/manual/en/pdostatement.bindparam.php). See [**this page**](https://phptherightway.com/#databases) and [**this post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) for some good examples. – Alex Howansky Feb 03 '22 at 22:13
  • Thanks it works, but I can't execute the query. I get the result -> false everytime. Do you have any tipps to cut strings for the query or extend strings ? – srepper Feb 03 '22 at 22:42

0 Answers0