Examples of vulnerable PHP code? [closed]

Question

Ok so me and a friend are doing a mini presentation on PHP security (I'm not really into PHP though) and he asked me to find some examples of vulnerable PHP code (one that is prone to SQL injections and all other types of attacks). I was wondering are there any websites with both good and bad pieces of code showing how you should and shouldn't code?

Basically I will put them into our website and he will try to hack it, then we will show the "proper" website and he will try to hack it again.

Answer 1

A really common beginner's mistake is forget to terminate script execution after a redirect.

<?php
if ($_SESSION['user_logged_in'] !== true) {
    header('Location: /login.php');
}

omg_important_private_functionality_here();

The solution:

if ($_SESSION['user_logged_in'] !== true) {
    header('Location: /login.php');
    exit();
}

This can be missed when testing in a normal browser, because browsers usually follow the Location header without rendering any of the output of the script.

Answer 2

SQL injection is easy:

$var = $_POST['var'];
mysql_query("SELECT * FROM sometable WHERE id = $var");

This is easily solved by:

$var = mysql_real_escape_string($_POST['var']);

The other common one is XSS (cross site scripting):

$var = $_POST['var'];
echo "<div>$var</div>\n";

allows you to inject Javascript that is run from your site. There are several ways of dealing with this, for example:

$var = strip_tags($_POST['var']);

and

$var = filter_var($_POST['var'], FILTER_SANITIZE_STRING);