Php Effective Anti Injection Script -> No symbol block

[anhnga]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Yes, how to put this code, where to put in the file?
One file or all file in web
etc: Where to put in MuWeb8.......
Thank!!!!!

 

[SlavOOn]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

When need this SQL anti injection? All problems in ' - quotes and ; - symbol...

Use:

if (!get_magic_quotes_gpc()) {
$... = addslashes($_POST['...']);
} else {
$... = $_POST['...'];
}

 

[WiWaWa]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

thx Good job. :technolog

 

[themad]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

When need this SQL anti injection? All problems in ' - quotes and ; - symbol...

Use:

You really should do some reading....
The addslashes() is not a function to use for such a thing. Simply said:
$charname=addslashes("Fluffy'; drop table character"); // you should get Fluffy\'; drop table character; -- right ? try to execute it and see what happens..
mssql_query("select Resets from character where Name='".$charname."'");

\' doesn't cut it with mssql...you have to use two single quotes in order to avoid it . Str_replace("'","'',$var);

The script i have brough simply filters ALL user inputed variables from browser to server and checks not to double filter ( i mean the ' to become '''''..etc.. ), effective and without having to check every single post/get var..

If you are using an addslashes() function as a protection..better change it fast..

 

[anhnga]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

You really should do some reading....
The addslashes() is not a function to use for such a thing. Simply said:
$charname=addslashes("Fluffy'; drop table character"); // you should get Fluffy\'; drop table character; -- right ? try to execute it and see what happens..
mssql_query("select Resets from character where Name='".$charname."'");

\' doesn't cut it with mssql...you have to use two single quotes in order to avoid it . Str_replace("'","'',$var);

The script i have brough simply filters ALL user inputed variables from browser to server and checks not to double filter ( i mean the ' to become '''''..etc.. ), effective and without having to check every single post/get var..

If you are using an addslashes() function as a protection..better change it fast..

Themad!
Please help me, how to add your script to muweb 08???, what file need to add....???
Thank!

 

[themad]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Themad!
Please help me, how to add your script to muweb 08???, what file need to add....???
Thank!

I have not downloaded muweb like..ever...i don't know how its build...can't help you

 

[eXtremee]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Hmm,my site uses sql_inject.php , if i'll put this script in it,script would work?

 

[forgetpass]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

It is a nice script but it won't put an end to malicious attack. In MUweb ppl still could get their board hacked by remote inclusion, in a web of czf there's xss ... But the script does good enough to stop sql injection. wat i fear is blind sql injection -.-

 

[UnKn]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

bug good man thx !!!

 

[favico]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Nice.. thx man
10/10
Keep it Up!

 

[Weedlord]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Does sombady already know where to put this file intro MuWeb 0.8 ? I dont have alot expierence intro Websites or any coding so please can sombady tell me where to put this intro MuWeb 0.8 ?

 

[AdidasS]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Weedlord, try put it in includes/character.class.php, there are functions of add/manage accounts. But i think muweb 0.8 is already full secure from sql inject and u don't need use this script (i don't use muweb that is only my opinion).
Sry for my eng.

 

[AdidasS]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Savoy, do u release all script of xweb?

 

[FCV2005]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

great man ...
thx

work 4 muweb ??

 

[Alekiel]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Thanks so much, good job:flag_schw

 

[kirka121]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

in muweb 0.8 u put this script into /includes/muweb.php
which makes the whole website become one blank page, which means that no, this script doesnt work with all websites -.-

 

[RisingKing2010]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

nice job... creative idea, apply a double single quote rather than removing it... seems simple enough and effective.

for those ppl that dont know how to use this, just paste this at the top of your index.php you shouldnt have many problems... the script automatically filters all data...

Wink Re: [Release] Php Effective Anti Injection Script -> No symbol block
Quote:
Originally Posted by themad View Post
You really should do some reading....
The addslashes() is not a function to use for such a thing. Simply said:
$charname=addslashes("Fluffy'; drop table character"); // you should get Fluffy\'; drop table character; -- right ? try to execute it and see what happens..
mssql_query("select Resets from character where Name='".$charname."'");

\' doesn't cut it with mssql...you have to use two single quotes in order to avoid it . Str_replace("'","'',$var);

The script i have brough simply filters ALL user inputed variables from browser to server and checks not to double filter ( i mean the ' to become '''''..etc.. ), effective and without having to check every single post/get var..

If you are using an addslashes() function as a protection..better change it fast..
Themad!
Please help me, how to add your script to muweb 08???, what file need to add....???
Thank!

I actually don't recommend using muweb 0.8 unless you redo all of the scripts, I have seen a lot of very effective scripts applied, including some of my own, get haxed on MW 0.8 :/

 

[kirka121]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

myea, i used to like muweb cause its so editable and simple. but now its plain garbage. unless someone comes up with the full and real fix to all the holes.
btw, i dont think this would work if u put in index.php, index.php is not the file whcih connects to mssql, if you put this in a file which actually has the connection scripts in it, page goes puff - blank.

 

[sexy4life]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

Well this looks like it will work only way to find out is to use it.

I am using it and ill let you know if any intrusions occur while using it .

Thanks themad good release 9/10 :winky:

 

[RisingKing2010]

Re: [Release] Php Effective Anti Injection Script -> No symbol block

myea, i used to like muweb cause its so editable and simple. but now its plain garbage. unless someone comes up with the full and real fix to all the holes.
btw, i dont think this would work if u put in index.php, index.php is not the file whcih connects to mssql, if you put this in a file which actually has the connection scripts in it, page goes puff - blank.

if you put it b4 the include "config.php"; or etc it clears all client controlled data before any scripts use that data... so its like:
open index.php
run the script //which fixed the data
connect to server //by including your connection file
call fixed data //like $account = $_POST['account'];
execute query with fixed data //you shouldn't need more protection than that... unless you want to be precaution

basically it has to be executed before your sql scripts are executed, in theory, it should work just by putting it at the top of the index.php because the index.php is where the site comes together, if you want to feel more secure you could put it be for the area where you connect to the server, but it should work the same if you put it at the top of the index