So I have two PHP files that execute SQL code in them. It's a simple registration script and an account recover script.
I want to know is my code safe from SQL exploits & other exploits? Here's how my code works.
how my registration system works
a person goes to my url with specified data such as the following example.
http://localhost/registeruser.php?identity=438746285267827419&idnumber=2201how my recovery account system works
user goes to this url with this specified data passed through.
http://localhost/accountrecovery.php?secretcode=GU3DZ99S4D73D9G7H
Below is the code for my following files
- registeruser.php
- accountrecovery.php
registeruser.php
<?php
setcookie('timerValueHolder', 0);
?>
<?php
if (!isset($_SESSION)) session_start();
$timeCurrently = round(microtime(true));
$UserRegTime = (isset($_SESSION["timeLastAccessed"])) ? $_SESSION["timeLastAccessed"] : '0';
if (($timeCurrently - $UserRegTime) > 3)
{
$_SESSION['timeLastAccessed'] = $timeCurrently;
}
else
{
header('refresh: 1');
die("cannot continue because you must wait " . (3 - ($timeCurrently - $UserRegTime)) . " seconds.");
}
$title = "User registration";
require_once ("header.php");
$passedInfo = $_GET['identity'];
$passedInfoTwo = $_GET['idnumber'];
if (strlen(trim($passedInfoTwo)) < 1)
{
echo "Invalid identification number of your account.";
setcookie('timerValueHolder', 0);
}
if (strlen(trim($passedInfo)) < 1)
{
echo "Invalid identification number of your account.";
setcookie('timerValueHolder', 0);
}
if ($_COOKIE['timerValueHolder'] >= 0)
{
if (strlen(trim($passedInfo)) > 0)
{
if (!isset($_COOKIE['timerValueHolder']))
{
setcookie('timerValueHolder', 0);
}
if (isset($_COOKIE['timerValueHolder']) && $_COOKIE['timerValueHolder'] < 4)
{
$servername = "localhost";
$username = "admin";
$password = "abc123";
$dbname = "databaseholder";
$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error)
{
die("Failed to Complete Connection: " . $conn->connect_error);
}
$usersIPAddress = $_SERVER['REMOTE_ADDR'];
$checkAction = mysqli_real_escape_string($conn, "select * from userconfiguration where membersID='$passedInfo' and MemberName<>''");
if ($checkAction > 0)
{
$checkActionRows = mysqli_num_rows($checkAction);
if ($checkActionRows > 0)
{
echo "please wait as web page refreshes until you see a successful message.";
}
}
else
{
$secondaryCheck = mysqli_real_escape_string($conn, "select * from userconfiguration where ipaddress='$usersIPAddress' and membersID='$passedInfo'");
if ($secondaryCheck > 0)
{
$rowCheckTwo = mysqli_num_rows($secondaryCheck);
if ($rowCheckTwo > 0)
{
echo "please wait as web page refreshes until you see a successful message.";
}
}
else
{
$sql = "INSERT INTO userconfiguration (ipaddress, membersID, TheirName)
VALUES ('$usersIPAddress', '$passedInfo', '$passedInfoTwo')";
if ($conn->query($sql) === true and $secondaryCheck > 0 and $rowCheckTwo > 0)
{
echo "please wait as web page refreshes until you see a successful message.";
}
else
{
echo "please wait as web page refreshes until you see a successful message.";
}
}
}
$conn->close();
$current_val = $_COOKIE['timerValueHolder'];
$current_val++;
setcookie('timerValueHolder', $current_val);
echo $_COOKIE['timerValueHolder'];
header('refresh: 4');
}
else
{
echo "success. go on to our application and finalize the registry by typing #finalizeregister ";
echo $_GET['identity'];
setcookie('timerValueHolder', 0);
}
}
}
?>
accountrecovery.php
<?php
setcookie('timerValueHolder', 0);
?>
<?php
if (!isset($_SESSION)) session_start();
$timeCurrently = round(microtime(true));
$UserRegTime = (isset($_SESSION["timeLastAccessed"])) ? $_SESSION["timeLastAccessed"] : '0';
if (($timeCurrently - $UserRegTime) > 3)
{
$_SESSION['timeLastAccessed'] = $timeCurrently;
}
else
{
header('refresh: 1');
die("cannot continue because you must wait " . (3 - ($timeCurrently - $UserRegTime)) . " seconds.");
}
$title = "user recovery";
require_once ('header.php');
$servername = "localhost";
$username = "admin";
$password = "abc123";
$dbname = "databaseholder";
$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error)
{
die("Failed to Complete Connectio: " . $conn->connect_error);
}
$passedData = $_GET['secretcode'];
$dataPassedTwo = mysqli_real_escape_string($conn, $passedData);
$actionCheck = mysqli_query($conn, "select * from userconfiguration where recoveryCode='$dataPassedTwo'");
$rowCheckAction = mysqli_num_rows($actionCheck);
$rowCount = mysqli_fetch_row($actionCheck);
if ($rowCheckAction > 0 and strlen(trim($passedData)) > 0)
{
echo "account recover details are ";
echo " your password: ", $rowCount[4];
echo " your security pin: ", $rowCount[5];
echo "to recover your account in the future you must do the following task.";
echo "in our application type #finalizeregister to obtain a new recovery code.";
$update = mysqli_query($conn, "UPDATE userconfiguration SET recoveryCode = '' WHERE recoveryCode = '$dataPassedTwo'");
if (!$update)
{
echo "An issue has occured in the update task.";
}
}
else
{
echo "failed to recover account. try typing #finalizeregister in our application for a new code to generate.";
}
$conn->close();
?>
session_start(); if (!isset($_SESSION)) session_start();. Have you heard of "prepared statements"? \$\endgroup\$