|
|
S-205: PHP-Nuke EasyContent Module 'page_id' Parameter Vulnerability
|
|
SQL-ACCEPTABLE-BY-4D(3) 1 SQL-ACCEPTABLE-BY-4D(3) SQL acceptable by 4D - PDO and SQL 4D 4D implements strictly the ANSI 89 standard, and have it enforced. It is highly recommended to read the 4D SQL documentation to learn about the available commands. The URL of the manual is : http://doc.4d.com/. Below is a list of 4D SQL characteristics: it is not exhaus- tive, but may serve as an introduction. Characteristics of 4D SQL +-------------------------------------+--------------------------------------+---+ | Characteristics | | | | | | | | | Alternative | | | | | | | | Note | | | | | | +-------------------------------------+--------------------------------------+---+ | INTEGER | | | | | | | | | Modify the SQL to use INT. | | | | | | | | INT is the supported integer type in | | | | 4Dv12.0. | | | | | | | CHAR | | | | | | | | | Use VARCHAR instead. | | | | | | | | Unsupported in 4Dv12.0 | | | | | | | UNION | | | | | | | | | Unsupported. Make separate queries. | | | | | | | | Unsupported in 4Dv12.0 | | | | | | | SELECT 1 + 1; | | | | | | | | | SELECT 1 + 1 FROM _USER_SCHEMAS; | | | | | | | | FROM is required | | | | | | | FLOAT | | | | | | | | | Cast the FLOAT value into a FLOAT or | | | | STRING, with an SQL 4D function | | | | (CAST, ROUND, TRUNC or TRUNCATE) | | | | | | | | Unsupported in current versions of | | | | the PDO_4D driver | | | | | | | Strong typing | | | | | | | | | Take care your SQL query, or your | | | | PHP code provides data with the | | | | expected type | | | | | | | | One must provide the right type | | | | that 4D expect. One can't insert '1' | | | | (as a string) in an INTEGER column. | | | | | | |PDO.execute(row)(3) : only works if | | | |all the table's column are of type | | | |TEXT or VARCHAR | | | | | | | | | Use the prepared statements, and use | | | | the right types. | | | | | | | | The PDO extension cast all values | | | | through execute() as string, and | | | | expect the SQL database to parse the | | | | values. | | | | | | | SELECT NULL FROM TABLE | | | | | | | | | Do not use NULL constants. Extract | | | | them from the table | | | | | | | | It is not allowed to use the NULL | | | | constant in the select list | | | | | | | SELECT * FROM TABLE WHERE 1 | | | | | | | | | Use WHERE 1 = 1 | | | | | | | | A constant can't be used in a WHERE | | | | clause | | | | | | | SHOW TABLES | | | | | | | | | Use system tables | | | | | | | | The list of tables, schemas, index, | | | | etc. are in these system tables : | | | | _USER_TABLES, _USER_COLUMNS, | | | | _USER_INDEXES, _USER_CONSTRAINTS, | | | | _USER_IND_COLUMNS, _USER_CONS_COL- | | | | UMNS, and _USER_SCHEMAS. | | | | | | | SQL structure delimiter | | | | | | | | | Use the following function to pro- | | | | tect SQL elements: function | | | | sqlEscapeElement(elem) { return '[' | | | | . str_replace(']',']]', $elem) . | | | | ']'; } | | | | | | | | To escape SQL elements names | | | | (tables, fields, users, groups, | | | | schema, primary key, etc.), the | | | | whole identifier must be between | | | | square brackets, and the closing | | | | brackets ']' must be doubled. | | | | | | +-------------------------------------+--------------------------------------+---+ PHP Documentation Group SQL-ACCEPTABLE-BY-4D(3)
