We Keep Coding

Manage confidential information in javascript

I have a table in my php that shows the data of a table in my database: username, email, etc. and I have also added an option to delete. The delete option works correctly and also shows a confirmation message with a necessary password before deleting.
I have the passwords saved in a table in the database but not encrypted.
The problem is that if a user explores the content of the page they can see what’s the password, so anyone can be able to delete data from the database. Therefore, a more or less skilled user can easily explore that content.
What can I do to prevent this from happening? Should I copy the same JavaScript code in another script and delete it from index.php? For more security, I tried to use a hash on the same index.php page but you can also see what the password is.
This is my code:
index.php
<table id="professorsRegistered" border="1px">
<tr>
<th colspan="3"><h2>Users</h2></th>
</tr>
<tr>
<th> Name </th>
<th> Email </th>
<th> Delete </th>
</tr>
<?php
$sql = "SELECT * FROM users"; /*Select from table name: users*/
$result = $conn->query($sql); /*Check connection*/
if ($result->num_rows==0){
echo "No users";
}else{
while($row = $result->fetch_assoc()) {
echo "<tr><td>".$row["username"]."</td><td>".$row["email"]."</td><td><a class='eliminate' onClick=\"getPass(".$row['id'].");\">X</a></td></tr>";
}
}
?>
</table>
<?php
$sql = "SELECT password FROM passwords WHERE passwords_id = '1';"; /*Select from table name: passwords*/
$result = $conn->query($sql); /*Check connection*/
$row = $result->fetch_assoc();
$password = $row["password"];
$hash = sha1($password);
/*echo "<p>".$hash."</p>";*/
?>
<script type = "text/javascript">
function getPass(user) {
var securePass = "<?php echo $password ?>";
var pass = prompt("Introduce password to delete: ", "Password");
if (pass!=securePass) {
return confirm('Incorrect Password');
}
else if (pass==securePass) {
window.location='delete.php?id='+user;
}
}
</script>
Delete.php
<?php
include('Conexion.php'); // Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$id = $_GET['id']; // $id is defined
mysqli_query($conn,"DELETE FROM users WHERE id='".$id."'");
mysqli_close($conn);
header("Location: index.php");
?>

To make this more secure you should look at doing the following:
Ensure that the credentials are validated in the server-side code (PHP), not the client side code. As malicious user can very easily either edit the JavaScript or post data directly to your server and totally bypass your code.
Passwords should be hashed with a appropriate password hashing algorithm. SHA1 is not a good algorithm for password hashing as it is too fast, which makes brute force and dictionary attacks easier. A better choice would be something like bcrypt or pbkdf2 these are much slower making the above attacks much more difficult. You should also salt your password. This means just adding some randomness to the password before it is hashed. This will help prevent an attack known as a rainbow table attack in which an attacker uses a set of pre-hashed values and corresponding plain text to speed up the brute force process.
Do not build SQL query stings by string contactination as this leaves your application vulnerable to SQL injection attacks. If a malicious user was to send up 1' OR 1=1 -- as the id parameter then all the users would be deleted, this technique could also be used dump all of the data from the database or even delete the database altogether. Look in to using parameterized queries instead.
Luckily there is already loads of information on how to do this the right way. I would recommend looking at the OWASP website which has plenty of examples.

There are a couple of things which are very wrong about this design. You need to fix them.
Do not store cleartext passwords in your database. Hash passwords using a password hash function (like PHP's password_hash() or sodium_crypto_pwhash()) before storing them in the database. (SHA1 is not a password hash, and should not be used for this purpose.)
Do not construct SQL queries with string interpolation or concatenation. You're already using PDO, so you can easily use parameter placeholders to prevent SQL injection.
Do not expose password hashes to the browser in any form. If you need to verify a password, submit it to the server as part of the request to perform a password-protected action, so that a user cannot bypass the password check by typing a URL in manually.

MYSQLI sending random long integer instead of data passed via ajax form

Edit: I got it working by removing prepared statements. All files using prepared statements broke at the same time. Is there some sort of server setting change that could have created this fiasco? Current PHP settings https://imgur.com/a/TpTwb7D
This has stumped me for hours now. I am trying to submit a user submitted form via jquery into the database and it works except posted integer fields that are submitted are random integers 8 characters long instead of the values submitted. Strings from the form are not passing anything at all. When I define the variables manually above the mysqli it works correctly. The form/field names are also correctly named in the HTML. Oddly enough I remember this code was working around 5 months ago, but I have no idea what changed. Any help is greatly appreciated!
I've noticed that another jquery form using the same method also broke which I know for a fact was working. It has the same issue of random integers being submitted. Lastly There is yet another form that does the same thing but without prepared statements which submits the data correctly.
PHP:
$urlId = $_POST['urlId'];
$giverId = $_SESSION["mem_id"];
$receiverId = $_POST['receiverId'];
$feedback = $_POST['feedback'];
$conn = new mysqli($host, $user, $passwrd, $db);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
if (!($stmt = $conn->prepare("INSERT INTO cc_feedback (url_id, giverId, receiverId, feedback, date) VALUES (?, ?, ?, ?, NOW())"))) {
echo "Prepare failed: (" . $conn->errno . ") " . $conn->error;
}
if (!$stmt->bind_param("iiis", $urlId, $giverId, $receiverId, $feedback)) {
echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
}
if (!$stmt->execute()) {
echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
}
$conn->close();
JS:
(document).ready(function() {
$('#feedback-form').submit(function(e){
e.preventDefault();
$.post('include/insertdata.php', $(this).serialize() )
.done(function(data){
// do stuffs
})
.fail(function(){
//alert('Ya done');
});
});
});
Database Entry:
If the form is submitted with the following fields:
urlId: 123
receiverId: 123
feedback: testing
giverId is session handled (we'll say 555 for user ID. This field works)
Then the data shows up in the DB as follows:
urlId: 39361776
receiverId: 39361904
feedback: NULL
giverId: 555
I checked that the data was passing to the file by setting the urlId to a separate session variable on the insertdata.php page. It shows up as the correct urlId (in this case 123)

posting data from website to MySQL using PHP does not work

I am new on PHP and trying to do get the user agent from the visitor of the website then send this information to the MySQL.
Home.html (this page has a button where the user should click on it to take him to another page where he will see his device information
<div id="TestMe_img">
<a href="Result.php">
<input type="submit" value="Test Your Device">
</a>
</div>
Result.php (the result page contain 2 things: 1- php code. 2- html code)
PHP
<?php
$server = "localhost";
$user = "root";
$pass = "";
$dbname = "user_data";
$userAgent = $_POST['userAgent'];
// Create connection
$conn = new mysqli($server,$user, $pass, $dbname);
// Check connection
if($conn -> connect_error) {
die("Conneciton Failed: " . $conn -> connect_error);
}
if (empty($userAgent)) {
echo "User Agent is blank";
die();
}
$sql = "INSERT INTO UserData (UserAgent) VALUES ('$userAgent')";
if ($conn -> query($sql) === TRUE) {
echo "Thank you! Hana is stupid";
}
else
echo "Unfortunately Hana is smart";
$conn -> close();
?>
HTML Part
<body onload="userAgent();">
<table>
<tr>
<td>user agent</td>
<td id="userAgent"></td>
</tr>
</table>
</body>
JavaScript
function userAgent(){
var userAgent = navigator.userAgent;
document.getElementById('userAgent').innerHTML = userAgent;
}
However, there is a mistake that I can not find because every time I click on the button it takes me to the result.php and show me the code on the browser with no result appear on the database!

OK, this is going to be slightly longer, but bear with me.
1st: You will be getting a "User Agent is blank" message, because the user agent is not actually submitted to the PHP page. You need to put an input (hidden or text) into a form, push the data inside and then submit that form. Change your HTML like this, then at least your date will be submitted:
<form method="post" action="Result.php">
<input type="hidden" id="userAgent">
<input type="submit" value="Test Your Device">
</form>
2nd: You don't even need to do that, because the userAgent is available to PHP already, even without submitting it manually. Just use this variable:
$_SERVER['HTTP_USER_AGENT']
3rd: You should NEVER put unsanitized input into an SQL string. This will lead to SQL injections and your server will be hacked.
Instead of:
$sql = "INSERT INTO UserData (UserAgent) VALUES ('$userAgent')";
$conn->query($sql);
You have to use a prepared statement (for pretty much any query that accepts variables), so that nobody can manipulate your query. Otherwise if your $userAgent variable contained a single quote, you could break out of your query and the attacker could inject any SQL code he wanted. So do this to fix your security issue:
$statement = $conn->prepare("INSERT INTO UserData (UserAgent) VALUES (?)");
$statement->bind_param('s', $userAgent);
$statement->execute();
The 's' parameter is actually one letter per each parameter you want to prepare in the statement. In this case it indicates you want to pass a string. "i" would be an integer, "d" a double, see here for more: http://php.net/manual/de/mysqli-stmt.bind-param.php
4th: Your question has absolutely nothing to do with phpMyAdmin, so you should probably change the title.
I hope this helps you get started.

How to have this form be validated on the same page?

Upon registering for an account for a subscription based product, I would like users to take a quiz. I want the results to be stored in a MySQL database. I've been using PHP and MySQL.
I have been able to have the quiz results and membership signup information sent to the database successfully, but verifying it is my issue because when the user goes back one page, then the quiz is reset.
For example, if a username is taken, the user is given an error and sent back to the quiz having to re-do the whole thing.
If there is a simple way to do it, I am interested in having javascript search the MySQL database for conditions such as if a username/email is already in use.
Right now, I have a javascript function that is called upon submitting the form. It currently only verifies that the two typed in passwords match each other. I would also it to call another function that searches that database and returns false if the username/email exists so that the user is not taken into another page.
This is how the code looks so far.
I am only experienced with very basic uses of php/MySQL. So my way of figuring this out was taking a free php/MySQL user system and modifying it to also insert results of the quiz into the table.
This is a common.php file that I include on each page.
'
// These variables define the connection information for your MySQL database
$username = "root";
$password = "*******";
$host = "localhost";
$dbname = "cc4u2";
// UTF-8 is a character encoding scheme that allows you to conveniently store
// a wide varienty of special characters, like ¢ or €, in your database.
// By passing the following $options array to the database connection code we
// are telling the MySQL server that we want to communicate with it using UTF-8
// See Wikipedia for more information on UTF-8:
// http://en.wikipedia.org/wiki/UTF-8
$options = array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8');
// A try/catch statement is a common method of error handling in object oriented code.
// First, PHP executes the code within the try block. If at any time it encounters an
// error while executing that code, it stops immediately and jumps down to the
// catch block. For more detailed information on exceptions and try/catch blocks:
// http://us2.php.net/manual/en/language.exceptions.php
try
{
// This statement opens a connection to your database using the PDO library
// PDO is designed to provide a flexible interface between PHP and many
// different types of database servers. For more information on PDO:
// http://us2.php.net/manual/en/class.pdo.php
$db = new PDO("mysql:host={$host};dbname={$dbname};charset=utf8", $username, $password, $options);
}
catch(PDOException $ex)
{
// If an error occurs while opening a connection to your database, it will
// be trapped here. The script will output an error and stop executing.
// Note: On a production website, you should not output $ex->getMessage().
// It may provide an attacker with helpful information about your code
// (like your database username and password).
die("Failed to connect to the database: " . $ex->getMessage());
}
// This statement configures PDO to throw an exception when it encounters
// an error. This allows us to use try/catch blocks to trap database errors.
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
// This statement configures PDO to return database rows from your database using an associative
// array. This means the array will have string indexes, where the string value
// represents the name of the column in your database.
$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
// This block of code is used to undo magic quotes. Magic quotes are a terrible
// feature that was removed from PHP as of PHP 5.4. However, older installations
// of PHP may still have magic quotes enabled and this code is necessary to
// prevent them from causing problems. For more information on magic quotes:
// http://php.net/manual/en/security.magicquotes.php
if(function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc())
{
function undo_magic_quotes_gpc(&$array)
{
foreach($array as &$value)
{
if(is_array($value))
{
undo_magic_quotes_gpc($value);
}
else
{
$value = stripslashes($value);
}
}
}
undo_magic_quotes_gpc($_POST);
undo_magic_quotes_gpc($_GET);
undo_magic_quotes_gpc($_COOKIE);
}
// This tells the web browser that your content is encoded using UTF-8
// and that it should submit content back to you using UTF-8
header('Content-Type: text/html; charset=utf-8');
// This initializes a session. Sessions are used to store information about
// a visitor from one web page visit to the next. Unlike a cookie, the information is
// stored on the server-side and cannot be modified by the visitor. However,
// note that in most cases sessions do still use cookies and require the visitor
// to have cookies enabled. For more information about sessions:
// http://us.php.net/manual/en/book.session.php
session_start();
// Note that it is a good practice to NOT end your PHP files with a closing PHP tag.
// This prevents trailing newlines on the file from being included in your output,
// which can cause problems with redirecting users.
This is at the top of registration.php
// First we execute our common code to connection to the database and start the session
require("common.php");
// This if statement checks to determine whether the registration form has been submitted
// If it has, then the registration code is run, otherwise the form is displayed
if(!empty($_POST))
{
// Ensure that the user has entered a non-empty username
if(empty($_POST['username']))
{
// Note that die() is generally a terrible way of handling user errors
// like this. It is much better to display the error with the form
// and allow the user to correct their mistake. However, that is an
// exercise for you to implement yourself.
die("Please enter a username.");
}
// Ensure that the user has entered a non-empty password
if(empty($_POST['password']))
{
die("Please enter a password.");
}
// Make sure the user entered a valid E-Mail address
// filter_var is a useful PHP function for validating form input, see:
// http://us.php.net/manual/en/function.filter-var.php
// http://us.php.net/manual/en/filter.filters.php
if(!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL))
{
die("Invalid E-Mail Address");
}
// We will use this SQL query to see whether the username entered by the
// user is already in use. A SELECT query is used to retrieve data from the database.
// :username is a special token, we will substitute a real value in its place when
// we execute the query.
$query = "
SELECT
1
FROM users
WHERE
username = :username
";
// This contains the definitions for any special tokens that we place in
// our SQL query. In this case, we are defining a value for the token
// :username. It is possible to insert $_POST['username'] directly into
// your $query string; however doing so is very insecure and opens your
// code up to SQL injection exploits. Using tokens prevents this.
// For more information on SQL injections, see Wikipedia:
// http://en.wikipedia.org/wiki/SQL_Injection
$query_params = array(
':username' => $_POST['username']
);
try
{
// These two statements run the query against your database table.
$stmt = $db->prepare($query);
$result = $stmt->execute($query_params);
}
catch(PDOException $ex)
{
// Note: On a production website, you should not output $ex->getMessage().
// It may provide an attacker with helpful information about your code.
die("Failed to run query: " . $ex->getMessage());
}
// The fetch() method returns an array representing the "next" row from
// the selected results, or false if there are no more rows to fetch.
$row = $stmt->fetch();
// If a row was returned, then we know a matching username was found in
// the database already and we should not allow the user to continue.
if($row)
{
die("This username is already in use");
}
// Now we perform the same type of check for the email address, in order
// to ensure that it is unique.
$query = "
SELECT
1
FROM users
WHERE
email = :email
";
$query_params = array(
':email' => $_POST['email']
);
try
{
$stmt = $db->prepare($query);
$result = $stmt->execute($query_params);
}
catch(PDOException $ex)
{
die("Failed to run query: " . $ex->getMessage());
}
$row = $stmt->fetch();
if($row)
{
die("This email address is already registered");
}
// An INSERT query is used to add new rows to a database table.
// Again, we are using special tokens (technically called parameters) to
// protect against SQL injection attacks.
$query = "
INSERT INTO users (
username,
password,
salt,
email,
style
) VALUES (
:username,
:password,
:salt,
:email,
:style
)
";
// A salt is randomly generated here to protect again brute force attacks
// and rainbow table attacks. The following statement generates a hex
// representation of an 8 byte salt. Representing this in hex provides
// no additional security, but makes it easier for humans to read.
// For more information:
// http://en.wikipedia.org/wiki/Salt_%28cryptography%29
// http://en.wikipedia.org/wiki/Brute-force_attack
// http://en.wikipedia.org/wiki/Rainbow_table
$salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647));
// This hashes the password with the salt so that it can be stored securely
// in your database. The output of this next statement is a 64 byte hex
// string representing the 32 byte sha256 hash of the password. The original
// password cannot be recovered from the hash. For more information:
// http://en.wikipedia.org/wiki/Cryptographic_hash_function
$password = hash('sha256', $_POST['password'] . $salt);
// Next we hash the hash value 65536 more times. The purpose of this is to
// protect against brute force attacks. Now an attacker must compute the hash 65537
// times for each guess they make against a password, whereas if the password
// were hashed only once the attacker would have been able to make 65537 different
// guesses in the same amount of time instead of only one.
for($round = 0; $round < 65536; $round++)
{
$password = hash('sha256', $password . $salt);
}
// Here we prepare our tokens for insertion into the SQL query. We do not
// store the original password; only the hashed version of it. We do store
// the salt (in its plaintext form; this is not a security risk).
$query_params = array(
':username' => $_POST['username'],
':password' => $password,
':salt' => $salt,
':email' => $_POST['email'],
':style' => $_POST['style']
);
try
{
// Execute the query to create the user
$stmt = $db->prepare($query);
$result = $stmt->execute($query_params);
}
catch(PDOException $ex)
{
// Note: On a production website, you should not output $ex->getMessage().
// It may provide an attacker with helpful information about your code.
die("Failed to run query: " . $ex->getMessage());
}
// This redirects the user back to the login page after they register
header("Location: login.php");
// Calling die or exit after performing a redirect using the header function
// is critical. The rest of your PHP script will continue to execute and
// will be sent to the user if you do not die or exit.
die("Redirecting to login.php");
}
?>
This is the javascript code that checks that the two entered passwords match
function checkPassword() {
var pass1 = document.getElementById("pass").value;
var pass2 = document.getElementById("c_pass").value;
if (pass1 != pass2) {
alert("Your passwords do not match.");
return false;
}
document.getElementById("quizForm").method="post";
document.getElementById("quizForm").action="register.php";
}
And of course here is a bit of the html of the quiz. I just included one question for the sake of length since this is already a long post. This is located in registration.php below the php code.
<form id="quizForm">
<h2>Which Style?</h2>
Classy <input type="radio" name="style" value="Classy"><br>
Formal <input type="radio" name="style" value="Formal"><br>
Alternative <input type="radio" name="style" value="Alternative"><br>
Natural <input type="radio" name="style" value="Natural"><br>
Night Life <input type="radio" name="style" value="Nightlife"><br>
Businessman/Professional <input type="radio" name="style" value="Businessman/Professional"><br>
Hip/Vintage <input type="radio" name="style" value="Hip/Vintage"><br>
Seductive <input type="radio" name="style" value="Seductive"><br>
Athletic <input type="radio" name="style" value="Athletic"><br>
Worldly <input type="radio" name="style" value="Worldly"><br>
<br>
Username:<br />
<input type="text" name="username">
<br /><br />
E-Mail:<br />
<input type="text" name="email" value="emaiil" placeholder="Email" />
<br /><br />
Password:<br />
<input type="password" id="pass" name="password">
<br /><br />
Confirm Password:<br>
<input type="password" id="c_pass" name="password">
<input type="submit" onclick="return checkPassword();" value="Register" name="Submit">
</form>

JavaScript runs on clients computer, it cannot do anything like this.
But, there is an option that you send an ajax request to a php file which would verify the data and then echo the result back to browser.
For more about AJAX: http://www.w3schools.com/php/php_ajax_php.asp

Deleting forum posts

I have a table with the following fields: wall_posts, group_id, id, and user_id.
Wall_posts is user entries, group_id is imported from another table and is just a unique group id, id is just a simple counter, and user_id gets the user id from the session.
My code gets rid of all the wall_posts if you press the delete button by comparing the user id to the user in session. I'm trying to find a way to delete individual posts and not all the posts by the user.
Here is the code:
if (isset($_POST['delete'])) {
$current_user = $_SESSION['user_id'];
$result = mysql_query("SELECT * FROM group_posts");
while ($user_id = mysql_fetch_array($result)) {
$id = $user_id['user_id'];
}
if ($current_user == $id) {
mysql_query("DELETE FROM group_posts WHERE $current_user = $id") or die(mysql_error());
}
}
How can I bound the delete button to individual posts instead of deleting all the posts made by the user currently in session?

Your SQL query above doesn't make sense - the WHERE statement should be in the form WHERE column_name = value.
Assuming id is the primary key for group_posts, as you're displaying posts, create a link for each post created by the author, e.g. Delete This Post for post with id 3. Then you'd do a query like this:
DELETE FROM group_posts WHERE id = postIdValueHere
Using the code pattern you have above:
if (isset($_POST['delete']) && $_POST['delete'] > 0) {
$current_user = $_SESSION['user_id'];
$post_id = (int) $_POST['delete'];
if ($current_user == $id) {
mysql_query("DELETE FROM group_posts WHERE id = $post_id AND user_id = $id") or die(mysql_error());
}
That query ensures that only posts with a given ID, created by the current author, can be deleted.
Does that answer your question?
Once you get more comfortable with SQL, you might also want to look into using prepared statements with mysqli or PDO. That will help your code clean and secure.

I'm assuming your delete buttons are simple links. Your links must contain all the information to delete a post. One way would be to pass a post id as a GET variable (e.g. link="myurl.com/posts/delete?id=#").
Your script would then at first make sure the current user is allowed to delete the post. For example:
$user_id = $_SESSION['user_id'];
$post_id = (int) $_GET['id'];
if(canDelete($user_id, $post_id))
{
// assuming post_id is unique for every post
$sql = sprintf("DELETE FROM group_posts WHERE id = %d", $post_id);
mysql_query($sql);
}
Of course, you'd have to implement canDelete($user_id) yourself.
By the way, "DELETE FROM group_posts WHERE $current_user = $id" always deletes every record in your table. At first you're comparing if $current_user equals $id and if they do happen to be equal, your query would look something like WHERE 1 = 1. I think you mean "DELETE FROM group_posts WHERE user_id = '$id'"
EDIT: It seems you want to use ajax for deleting your posts. I recommend using jQuery or any other proper javascript framework as it saves you time. Here is a link from the jQuery documentation describing how to make an ajax call to the server and a similar question to help you understand better.