An error was encountered: MySQL injection?

[klaush]

Hello Chuck,

is the following error known? We got this today for the first time:


An error was encountered during execution of the query:

SELECT id,cat FROM pp_products WHERE approved=1 AND ((title LIKE "% !S!WCRTESTINPUT000000!E!%" OR description LIKE "% !S!WCRTESTINPUT000000!E!%" OR keywords LIKE "% !S!WCRTESTINPUT000000!E!%" OR bigimage LIKE "% !S!WCRTESTINPUT000000!E!%"
OR extra1 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra2 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra3 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra4 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra5 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra6 LIKE "% !S!WCRTESTINPUT000000!E!%") OR (title LIKE "!S!WCRTESTINPUT000000!E!%" OR description LIKE "!S!WCRTESTINPUT000000!E!%" OR keywords LIKE "!S!WCRTESTINPUT000000!E!%" OR bigimage LIKE "!S!WCRTESTINPUT000000!E!%"
OR extra1 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra2 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra3 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra4 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra5 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra6 LIKE "%!S!WCRTESTINPUT000000!E!%")) AND (user LIKE '%!S!WCRTESTINPUT000001!E!%') AND price >= 0.00 AND price

Thanks

Klaus

[Chuck S]

Can you post the full error seems yours is cut off in mid stream

[klaush]

That´s the whole message, Chuck.

Greeting

Klaus

[klaush]

Just got another one:

An error was encountered during execution of the query:

SELECT id,cat FROM pp_products WHERE approved=1 AND ((title LIKE "% !S!WCRTESTINPUT000000!E!%" OR description LIKE "% !S!WCRTESTINPUT000000!E!%" OR keywords LIKE "% !S!WCRTESTINPUT000000!E!%" OR bigimage LIKE "% !S!WCRTESTINPUT000000!E!%"
OR extra1 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra2 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra3 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra4 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra5 LIKE "% !S!WCRTESTINPUT000000!E!%" OR extra6 LIKE "% !S!WCRTESTINPUT000000!E!%") OR (title LIKE "!S!WCRTESTINPUT000000!E!%" OR description LIKE "!S!WCRTESTINPUT000000!E!%" OR keywords LIKE "!S!WCRTESTINPUT000000!E!%" OR bigimage LIKE "!S!WCRTESTINPUT000000!E!%"
OR extra1 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra2 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra3 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra4 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra5 LIKE "%!S!WCRTESTINPUT000000!E!%" OR extra6 LIKE "%!S!WCRTESTINPUT000000!E!%")) AND (user LIKE '%!S!WCRTESTINPUT000001!E!%') AND price >= !S!WCRTESTINPUT000007%3c%3e!E! AND price

[Chuck S]

Maybe try altering your search script the typecast line low and high make sure they are set to INT not STRING?

Content visible to verified customers only.

[klaush]

Sorry Chuck, where do i find this and what do you exaxtly mean by that?

Greetings

Klaus

Originally Posted by Chuck S

Maybe try altering your search script the typecast line low and high make sure they are set to INT not STRING?

Content visible to verified customers only.

[Chuck S]

At the top of your search.php script in your classifieds directory.

You will see the typecast line I noted and make sure as in bold you use INT not STRING.