Help from hackers !!! L2O

[DuA11]

Some of the accounts in the server become: Nick_1025_2341, Nicker_1024_2345 etc...
How to solve this problem???
What is happening???? HOW???
(and those chars are deleted to) PLZ HELP !!!

 

[tavisf]

I don't know exactly try bloking all of you're port exept the ones that you don't use this way will not get hacked more often because the Hacker wont have a backdoor !!! Y don't know iff it will help you but you're Pc will be a lot secure with this metod and be carefull what Port you block okay ! Plz reply !!!

 

[DuA11]

i think it is about asp website... could it be?

 

[Hitomi]

Erm that type of name is normal when a player deletes a char.

 

[DuA11]

When player delete's his char it doesn't show in the top100
And half players in the server does'nt delete their chars at the same time...
And i think names with endings _1025_2341 in "user_data" table is something else, or I am wrong???

 

[Sundh]

i think you got an sql injection, if you dont have a secured asp reg page i sugest you fix this problem and i also sugest that you switch from asp to php if you got support for it.

 

[DuA11]

how to fix this prob??? on reg page??? asp?

 

[snoworm]

lol thises deleted char dont worry

 

[Sundh]

well if you dont have a sql injection protection code in your reg page i sugest you shutdown the reg page untill you added one. Else you will have big problem's if someone do/have done a sql injection.

 

[DuA11]

could someone post sql injection protection code ?
And still tell me more information about these deleted chars...

 

[bob1122]

lol, i think you can find this in search, but since i could care less about posting that.
You really should tihnk about switching to PHP seriosly, next search for the anti sql inject or :

function antiinjection($str) { 
$banwords = array ("'", ",", ";", "--", " or ", ")", "(", " OR ", " and ", " AND ","/n","/r"); 
if ( eregi ( "[a-zA-Z0-9]+", $str ) ) { 
$str = str_replace ( $banwords, '', strtolower ( $str ) ); 
** else { 
$str = NULL; 
** 
$str = trim($str); 
$str = strip_tags($str); 
$str = addslashes($str); 
$str = htmlspecialchars($str); 
return $str; 
**

** = ( opposite of this { )
B.t.w i didnt write that

 

[darkagent]

fix for this is so simple: try to change your SQL request in TOP:
select...... where account_id>0 and builder=0..etc..
this names are always for DELETED chars.. and server changes their account_id to "-1"...so your top100 pages looks like buggy

 

[DuA11]

thank you darkagent !