Okay, thanks for giving credits, but I think it is easier if I explain it to
you, and then you can fix it and also avoid it in the future :)
Here is the explanation:
In short, variables from HTTP requests are not safe.
Ex: $name = _GET[x] or $pass = _POST[x]
Because the variables come from the "user" (their browser). Even if it is a
POST request, there are many tools that allow usrs to customize a POST
requst.
So, if this kind of variable is used to construct HTML code or SQL code,
then they must be "filtered" or "sanitized" first, usually using
htmlspecialchars() or htmlentities().
So, if somewhere in your code, you have: echo "Hello, " $name
Then the code is insecure because an "untrusted" or "tainted" variable is
used directly to construct HTML. This code then is vulnerable to cross-site
scripting.
The same, if somewhere in your code, you have: mysql("Select ....... where
name = " .$name), then it is worse, because name can contain a malicious
pattern that will allow the attacker to execute ANY sql commands--that's one
of the main reasons that credit-card numbers get stolen. This is called SQL
injection.
So, the fix is easy, before using it, do htmlspecialchars($name). But to
prevent SQL injection, you need to write your own filter, and filter out
special SQL characters such as ' ; " and so on.
The best source of information would be the OWASP project, at:
http://www.owasp.org. Look under the "Quick Link" section in the lower-left
corner for "OWASP Guide" and "Top Ten." Then concentrate on the "SQL
injection" and "cross-site scripting" sections. Basically, before using HTTP
variables, we have to sanitize them. It is easy to do; perhaps just use the
httpspecialchars() function. Good luck!
The vulnerabilities reported to you were found using our VeriPHP-a security
verifier for PHP code. We're currently using it to conduct experiments and
to verify open source code that we use. We're evaluating whether it is
worthwhile to prepare and release the tool for public use (for free)...would
you be interested in using such a tool, if made available? Thanks!