Submeter #882424: code-projects Barangay Resident Profiling Management System (BRPMS) / Barangay San Fabian 1.0 SQL Injection

A SQL injection risk exists in the resident search functionality of BRPMS.

The endpoint receives the search parameter from $_GET, escapes it with real_escape_string(), and then concatenates the escaped value into a SQL fragment:

$search = $_GET['search'] ?? '';
$esc = $conn->real_escape_string($search);
$search_query = " AND (r.first_name LIKE '%$esc%' OR r.last_name LIKE '%$esc%' OR h.purok LIKE '%$esc%')";

That fragment is later embedded directly into the final query:

$sql = "SELECT r.*, h.household_no, h.purok
FROM residents r
JOIN households h ON r.household_id = h.id
WHERE r.is_archived = ? $search_query
ORDER BY r.last_name, r.first_name";

Although real_escape_string() reduces the chance of a trivial quote breakout, this is still unsafe SQL construction. The query should use placeholders for all attacker-controlled values. Relying on escaping is brittle because its correctness depends on connection character set and SQL mode behavior. The database connection in db.php also does not explicitly set the connection character set with set_charset('utf8mb4').

Relevant code:

residents.php, lines 10, 17, 18, and 21-26
db.php, line 13

• Fonte: ⚠️ https://gist.github.com/c4ttr4ck/504e89cacf12c7d6a87490f3859dfded
• Utilizador: c4ttr4ck (UID 75518)
• Submissão: 07/07/2026 22h27 (há 2 meses)
• Moderação: 23/08/2026 08h08 (2 months later)
• Estado: Aceite
• Entrada VulDB: 394526 [code-projects Barangay Resident Profiling Management System 1.0 Resident Search Functionality residents.php Pesquisa Injeção SQL]
• Pontos: 20