function DatabaseQueryTestCase::testConditionOperatorArgumentsSQLInjection

Tests SQL injection via condition operator.

File

modules/simpletest/tests/database_test.test, line 3640

Class

DatabaseQueryTestCase

Drupal-specific SQL syntax tests.

Code

public function testConditionOperatorArgumentsSQLInjection() {
  $injection = "IS NOT NULL); INSERT INTO {test} (name) VALUES ('test12345678'); -- ";
  try {
    $result = db_select('test', 't')->fields('t')
      ->condition('name', 1, $injection)
      ->execute();
    $this->fail('Should not be able to attempt SQL injection via condition operator.');
  } catch (InvalidQueryConditionOperatorException $e) {
    $this->pass('SQL injection attempt via condition arguments should result in a database exception.');
  }
  // Test that the insert query that was used in the SQL injection attempt did
  // not result in a row being inserted in the database.
  $result = db_select('test')->condition('name', 'test12345678')
    ->countQuery()
    ->execute()
    ->fetchField();
  $this->assertFalse($result, 'SQL injection attempt did not result in a row being inserted in the database table.');
  // Attempt SQLi via union query with no unsafe characters.
  db_insert('test')->fields(array(
    'name' => '123456',
  ))
    ->execute();
  $injection = "= 1 UNION ALL SELECT password FROM user WHERE uid =";
  try {
    $result = db_select('test', 't')->fields('t', array(
      'name',
      'name',
    ))
      ->condition('name', 1, $injection)
      ->execute();
    $this->fail('Should not be able to attempt SQL injection via operator.');
  } catch (InvalidQueryConditionOperatorException $e) {
    $this->pass('SQL injection attempt via condition arguments should result in a database exception.');
  }
  // Attempt SQLi via union query - uppercase tablename.
  db_insert('TEST_UPPERCASE')->fields(array(
    'name' => 'secrets',
  ))
    ->execute();
  $injection = "IS NOT NULL) UNION ALL SELECT name FROM {TEST_UPPERCASE} -- ";
  try {
    $result = db_select('test', 't')->fields('t', array(
      'name',
    ))
      ->condition('name', 1, $injection)
      ->execute();
    $this->fail('Should not be able to attempt SQL injection via operator.');
  } catch (InvalidQueryConditionOperatorException $e) {
    $this->pass('SQL injection attempt via condition arguments should result in a database exception.');
  }
}