From: michael libby <x@...>
Date: 2002-09-20T11:41:47+09:00
Subject: Re: CGI - Ruby Data Types

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday 19 September 2002 21:12, Matthew, Graeme wrote:
> Im from a perl background so im having some trouble as I am not used to
> having to check my data types
> for example , I have my CGI script
>
> cgi = CGI.new
> id = cgi['id']
>
> prj = Project.new(id)
> print prj.DisplayProject
>
> when I print id.type is states that it is an array ?
>
> my project class needs to check the value of id because if it is passed
> as a valid ie > 0 integer then the user is requesting you to load the
> data for the project, the problem is it never fails below so when no id
> is passed then it still tries to execute the SQL
>
> def initialize(id)
>
> 		if id
>
> 			db = Db.connection
> 			sql = SQL_PROJECT + " WHERE prj_id = #{id} "
> 			print sql
> 			qry = db.prepare(sql)
> 			qry.execute
> 			@data = qry.fetch_hash
> 			qry.finish
> 		end
>
> end
>

You may not be used to checking data types, but you should be used to 
verifying data from your CGI before you pass it to your RDBMS in a SQL 
statement! What if someone sends you:

id=1%3Bdelete%20*%20from%20table_name%3B

as the parameter? That could really ruin your day... it translates to:

id=1;delete * from table_name;

which your script-- as shown-- would simply attempt to execute. You have a 
lot more faith in mysql.rb than I do, if you expect it to protect you from 
this sort of attack.

In this case though, you want to write:

id = cgi.param('id') #instead of id = cgi['id']

to get at your argument in string form, and then 

if /^\d+$/.match(id) # instead of if id

which will test that the id was just numbers. Modify regex as necessary to 
get valid values for your field.

 -michael
 
++++++++++++++++++++++++++++++++++++++++++
Michael C. Libby <x@ichimunki.com>
public key: http://www.ichimunki.com/public_key.txt
web site: http://www.ichimunki.com
++++++++++++++++++++++++++++++++++++++++++
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE9iooN4ClW9KMwqnMRAvMaAJoD8xQNWoYz1YDKRQz+kKDKvn5WHQCgnax5
tVckzBP4Ox3XUW2WLNoFsx8=
=h7EJ
-----END PGP SIGNATURE-----