-7

I was thinking to make some jQuery functions that will use ajax to control mysql. The whole idea is to make separate files of PHP (e.g query.php, addRow.php, update.php and delete.php) provide data to them via the GET variables like query.php?sql=SELECT * FROM table and then control them with jQuery AJAX functions that I'll make later. Expected code:

$(element).click(function (e) {
    mysql.query("DELETE row FROM table WHERE name = 'John Doe'");
});

And then it'll send query through AJAX and the query will be performed.
So the problem is SECURITY . I mean anyone can just change javascript from browser's inspector or use console to control my databases. What can be done for this problem. Is there anyway to not let anyone change elements in the browser console. If not is there ANYWAY to overcome this security problem?

  • 35
    Please don't architect your application like this. You know this is a security issue, so doesn't that suggest you might simply be doing it wrong instead of trying to block people inspect the HTML? – ozz May 3 '14 at 8:41
  • 1
    Database interaction in this way is EXTREMELY BAD don't do it. – Pieter B May 23 '14 at 11:20
  • 6
    Is this site up and running? Just asking for the url for a friend. – pllee May 23 '14 at 16:32
29

Never expose direct access to your database from the web layer. You can never lock that down; someone will send "DROP TABLE table" to your server, however much you lock down the JS source.

All they have to do is see what the browser sends to your server to detect that your server accepts arbitrary SQL commands.

Not that you can lock down the JS code; it is not the browser you need to worry about, anyone can send a HTTP request and start introspecting your client-side code anyway.

Build a RESTful API instead, use that from the client. Such an API is limited in the damage it can do if someone starts calling it directly.

  • Hey What's this rest API? – Rana Faiz Ahmed May 3 '14 at 7:54
  • @RanaFaizAhmed: I linked you to a Stack Overflow post. – Martijn Pieters May 3 '14 at 7:55
  • 7
    @RanaFaizAhmed: Also have a look at 'SQL injection', because moving the SQL to the server is not 100% the solution and mat still leave your site vulnerable. – thorsten müller May 3 '14 at 8:15
  • 1
    See Theo's answer to How can I prevent sql injection in php? for an explanation of thorsten's point; it is important to build your restful API safely. Ignore any suggestions (in other answers) to escape strings. – Brian May 3 '14 at 15:17
  • 3
    Ah, yes, Little Bobby Tables :-) – Ross Patterson May 4 '14 at 1:51
7

Is there anyway to not let anyone change elements in the browser console. If not is there ANYWAY to overcome this security problem?

No.

Anything that is in an HTTP response delivered to a user's machine can be intercepted and read / changed by the user ... if they have a little bit of technical expertise. That includes anything that is delivered encrypted, and decrypted on the fly in the user's browser.

And even if you could prevent the user tweaking your SQL in the webpage, you can't prevent them sending a different SQL to your database, using the database auth credentials that you embedded in your Javascript.

0

I would suggest not to expose your database over the web this will have high risk on SQL Injection and data distortion.

Rather than to this you can create a separate data access layer which is a short of database functions which will interact with data base. Every time you need to include the required function file to your code and pass the connection object by reference to the function.

Also make sure function will not use $_SESSION register global at all.

Make separate database configuration file which contain database name, user name and password other relevant information. Now create connection object with use of those configuration details and pass the single connection object by reference to whatever query you fire.

Advantages of this.

  1. This will reduce total no of database connection
  2. reduce security risk because dbconfig.inc, dataretrive.fn.php and other related file are kept in limited access directory which is even not accessible by crawlers.
  3. Site will use common database connection pool automatically.
0

Is there anyway to not let anyone change elements in the browser console

Use Flash ;)

But seriously... never make your security depend on anything in the browser. Someone could always simulate a browser, for example. Whatever is not in your direct control (i.e. on a locked server) has no guarantees.

-1

As a 20+ years programmer i am surprised HTML/php programming is so weak in how a user can use inspect element to change a value e.g product id before submitting.

My solution is to use java script variables and only use HTML such as textboxes to inform the user of my intentions.

eg declare variables in a global space i.e outside of a function.

Example below uses j query library.

It is a small example.

The demonstration is that changing the value of textbox c using inspect element will not change the final result displayed in result textbox.

When saving the data to server save the javascript values to the server... not the html values.

             <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script>

      <script>
      var a = 0;
      var b = 0;
      var result= 0;
      </script>

and i can use the values while informing the user in HTML textboxes

      <script>
       a = 5;
       $('#a').val(a);
       b = 3;
       $('#b').val(b);




       result=a+b;
       $('#result').val(result);

       alert(result);

       </script>

  • 1
    Using JavaScript variables doesn't solve the problem: it's always possible for someone to tamper with the code that their browser is running, or forego the browser entirely and write a custom script to send malicious requests to your server. The server can't trust anything received from the client. Always verify that the input is valid and permitted. – Wyzard Apr 20 '15 at 1:56
  • @wyzard. I hear this argument a lot and generally how one cannot protect even the server so to speak. I think some times people are just reciting what they have heard. My own test shows that you cannot use inspect element to change a value or data generated with js... as is possible with html. Trying to make a fully functional accounting system that keeps referring to server for every authentication is a herculean task. There seems to be hope on js. I intend to test is better but so far so good. And believe me security is everything to me. I mainly deal with accounting softwares. – webs Apr 20 '15 at 21:04
  • 1
    You've tested that a particular version of a particular browser doesn't let the user modify certain JavaScript values using the built-in developer tools, but people can use browser extensions, or different browsers, or other programs entirely. An attacker could use a tool like wget or Poster to send a custom request to your sever, with any data that the attacker wants — even data that couldn't have been produced by your JavaScript code. The server cannot trust the client. – Wyzard Apr 20 '15 at 21:43
  • 1
    The server shouldn't just "delete any submitted id received"; it should check that the user is authorized to delete that ID, and only delete it if the authorization check passes. Then it doesn't matter if someone changes an ID from 1 to 30 in the browser, because they don't gain anything by doing so. – Wyzard Apr 20 '15 at 23:06
  • 1
    If the user is authorized to delete record 30, it's not a security problem if they do it by editing an ID in the browser. From a security standpoint, the server doesn't really care how the delete request was produced; all that matters is whether the user is authorized to delete the record they're trying to delete. All JS checks can be bypassed (e.g. with Poster), so you cannot prevent the user from sending a request to delete an unauthorized record. The server has to be smart about deciding whether to honor that request. – Wyzard Apr 21 '15 at 0:02
-2

I think you should go for disable right click on your web page

<script type="text/javascript">

$(document).ready(function () { //Disable cut copy paste

$('body').bind('cut copy paste', function (e) {

    e.preventDefault();

});

//Disable mouse right click
$("body").on("contextmenu",function(e){
    return false;
});

});

protected by gnat Sep 5 at 6:20

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.