[Sticky] SQL Injection vulnerability in eFiction

I did this change but now when I click submit button everything is OK but when I want to echo inserted text, it shows between the lines "rn" (in database shows rn). I tried to remove these tags but it doesn't disapear. How could I remove these tags?

(You can skip step 2 if you know are using mysqli extension, if you are not sure, better do it.)
Step 2:
Open includes/mysqli_functions.php, find at or around line 56:

// Used to escape text being put into the database.
function escapestring($str) {
   if(version_compare(phpversion(),"4.3.0")=="-1") {
     $str = mysql_escape_string($str);
   } else {
     $str = mysql_real_escape_string($str);
   }
   return $str;
}

Modify to:

// Used to escape text being put into the database.
function escapestring($str) {
   if (!is_array($str)) return mysql_real_escape_string($str);
   else return array_map('escapestring', $str);
}

This will no longer probe for PHP versions before 4.3.0, but honestly, this would mean your web server has not been updated since around 2003.

I couldn't find that code in includes/mysqli_functions.php but could in includes/mysql_functions.php, so was assuming there's a tiny typo in step 2 or am I wrong and my files are different than expected somehow?

Holy Batman, fired a bit too far here ^^

I changed the instructions above, in short terms: changes in the config.php modification, edit an additional file.

Thank you, now its ok

Thank you for getting on this so quick!

Series doesnt show whit

$seriesid = (isset($_GET['seriesid']) && is_numeric($_GET['seriesid'])) ? escapestring($_GET['seriesid']) : false;

I get error in line 39 viewseries.php.

But its ok if I use:

$seriesid = isset($_GET['seriesid']) && is_numeric($_GET['seriesid']) ? escapestring($_GET['seriesid']) : false;

I dont know if it is ok to use this last code

Whoa - thanks Robert for the quick spot and thanks Sheepie for the fix.

A quick search didn't find those lines of code in the files. There was similar code but not the same.

Please hurry up on the fixed version as at least I can upload that!

Thank you, Robert for pointing this out, and thank you, Sheepcontrol for working on the fix.

I wanted to point out that the 2 lines of code that were previously added to the config.php file, and now are listed for the dbfuctions.php file:

$_GET = array_map('stripslashes', $_GET);
$_POST = array_map('stripslashes', $_POST);

May help with the SQL injection issue, but they throw off some of the site functionality. A member of my site emailed me to let me know that when she was trying to add a challenge, the site wouldn't save the characters she was trying to tie to the challenge. I checked, and she was correct. It looks like any input that comes from a box where multiple options can be chosen is being disregarded (for ex. in the advanced search it won't use selected classtypes to include/exclude).

UPDATE: zip-archive attached with the modified files.

Updated package is postponed, also, until this fix has become somewhat stable.

Sheep, I think you are great to tackle this problem but I'm confused... is there an attachment on your post or not? I see a paperclip on the header like there is an attachment but I could find no link. I will attempt to manually alter my files, but if I do, will I screw something up? Seems like there are some unpredictable results.

Darn, that's what I was fearing. Well, as I said, I don't know the code very well, ok, scratch that as well - I need to finish v5 ASAP 🙁

Hey I'm ready to beta test v5 whenever you are ready.  :agree:

I'm getting a bunch of reports from authors stating that "rn" is being added to each line since I applied the hotfix.  Here's an example:

http://www.adastrafanfic.com/viewstory.php?sid=2061&chapter=37

No matter what I do on the HTML editor side, I cannot remove those characters.  They persist over and over.

-- jb

Can I get a post of Step 3 so I can back out the changes?

-- Jb

EDIT: Nevermind.  I found it and edited it out.

Darn, that's what I was fearing. Well, as I said, I don't know the code very well, ok, scratch that as well - I need to finish v5 ASAP 🙁

Hey I'm ready to beta test v5 whenever you are ready.  :agree:

I'd also be up for doing any beta testing when you are ready. 

It seems to be.  Once I backed out the config.php changes, all of the weird extra characters disappeared when I did the hand-edits to the HTML input editor.

-- jb