SecurityTest.php

<?php
require_once 'Security.php';

class SecurityTest extends PHPUnit_Framework_TestCase
{
    /**
     * @var Security
     */
    protected $object;

    protected function setUp()
    {
        $this->object = new Security;
    }

    protected function tearDown()
    {
    }

    public function testCheckInjection()
    {
        $response = $this->object->checkInjection('\' or 1=1');
		$this->assertTrue($response);
		$response = $this->object->checkInjection('\' or \'');
		$this->assertTrue($response);
		$response = $this->object->checkInjection("anything' OR 'x'='x");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("x' AND email IS NULL; --");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("x' AND 1=(SELECT COUNT(*) FROM tabname); --");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("x' AND members.email IS NULL; --");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("x' OR full_name LIKE '%Bob%");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("[email protected]' AND passwd = 'hello123");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("x'; DROP TABLE members; --");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("23 OR 1=1");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("\'; DROP TABLE users; --");
		$this->assertTrue($response);

		$response = $this->object->checkInjection('\';alert(String . fromCharCode(88, 83, 83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>');
		$this->assertTrue($response);
		$response = $this->object->checkInjection("'';!--\" < XSS>=&{()}");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=\"javascript:alert('XSS');\">");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=javascript:alert('XSS')>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=JaVaScRiPt:alert('XSS')>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=javascript:alert(&quot;XSS&quot;)>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=`javascript:alert(\"RSnake says, 'XSS'\")`>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection('<IMG """><SCRIPT>alert("XSS")</SCRIPT>">');
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection('<IMG SRC="jav	ascript:alert(\'XSS\');">');
		$this->assertTrue($response);
		$response = $this->object->checkInjection('<IMG SRC="jav&#x09;ascript:alert(\'XSS\');">');
		$this->assertTrue($response);
		$response = $this->object->checkInjection('<IMG SRC="jav&#x0A;ascript:alert(\'XSS\');">');
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG\nSRC\n=\n\"\nj\na\nv\na\ns\nc\nr\ni\np\nt\n:\na\nl\ne\nr\nt\n(\n	\n\'\nX\nS\nS\n\'\n)\n\"\n>\n");
		$this->assertTrue($response);
		$response = $this->object->checkInjection("<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>");
		$this->assertTrue($response);
		$response = $this->object->checkInjection('<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-/SCRIPT+AD4-');
		$this->assertTrue($response);


		$response = $this->object->checkInjection('fatih');
		$this->assertFalse($response);
		$response = $this->object->checkInjection('or');
		$this->assertFalse($response);
		$response = $this->object->checkInjection('and');
		$this->assertFalse($response);
		$response = $this->object->checkInjection('union');
		$this->assertFalse($response);
		$response = $this->object->checkInjection('drop table');
		$this->assertFalse($response);
		$response = $this->object->checkInjection('12 or');
		$this->assertFalse($response);
		$response = $this->object->checkInjection('-');
		$this->assertFalse($response);
		$response = $this->object->checkInjection('\"');
		$this->assertFalse($response);
    }
}