Secure site ?

[Alkyron]

Hello everyone, I'm looking for a way to secure my site (MPOG) because

my site is hacked (LEVEL 99 ALL).​

 

[Solaire]

Your release stripped that and much more:

http://forum.ragezone.com/f245/my-way-of-protecting-from-sql-injections-570599/?#post4993113

function antisql($sql) {
    $sql = preg_replace(sql_regcase("(select|union|0x|cast|exec|varchar|insert into|delete from|update account|update login|update character|ugradeid|drop table|show tables)"),"",$sql);
    $sql = trim($sql);
    $sql = strip_tags($sql);
    $sql = addslashes($sql);
    return $sql;
}

Let's see - words such as "select" and "varchar" are automatically removed, without notifying anyone - as I mentioned, if my password were say, "select1", then my password would be "1" without the end user being notified.

Rather than remove excess spaces and tags, it's easier to not permit those symbols.

Also, your add slashes will cause an annoyance if magic_quotes_gpc is on, as detailed in

To view the content, you need to sign in or register

. (e.g.: \' would turn to \\\', inserting a backslash before the quote).

So no, that s most certainly not what you were doing.

That's not what I use either, it's what I released. What I used back then was for MySQL.:

function sqlesc($x) {
$x = stripslashes($x);
return "'".mysql_real_escape_string($x)."'";
}

Also,

if (!get_magic_quotes_gpc()) {
$sql = addslashes($sql);
}

 

[Guy]

That's not what I use either, it's what I released. What I used back then was for MySQL.:

function sqlesc($x) {
$x = stripslashes($x);
return "'".mysql_real_escape_string($x)."'";
}

Uhh..why are slashes being stripped? And, why wouldn't you just do:

function sqlesc ( $x ) {
 return mysql_real_escape_string ( stripslashes ( $x ) ); // stripslashes() still isn't needed..
}

Also,

if (!get_magic_quotes_gpc()) {
$sql = addslashes($sql);
}

That still doesn't represent the function you released, which you still claimed, "just felt safe".

Also, where's your MSSQL equivalent? Is your MSSQL equivalent the one you released?

I don't see why anyone would put "select" as their password anyways it would be rare if anyone did though.

It's all theoretical.

 

[Solaire]

Uhh..why are slashes being stripped? And, why wouldn't you just do:

function sqlesc ( $x ) {
 return mysql_real_escape_string ( stripslashes ( $x ) ); // stripslashes() still isn't needed..
}

That still doesn't represent the function you released, which you still claimed, "just felt safe".

Also, where's your MSSQL equivalent? Is your MSSQL equivalent the one you released?



It's all theoretical.

I don't know why I didn't use it, variables don't really matter. It was a matter of keeping it clarifying probably.

Also, that "just felt safe" was just a joke, lol. Don't be so serious. I've got lots of experience in MySQL injections, I'm looking into MSSQL ones ATM. Thought they were the same.

 

[Guy]

I've got lots of experience in MySQL injections, I'm looking into MSSQL ones ATM. Thought they were the same.

Having experience in modifying queries via unchecked forms isn't something you can have experience in - unless you've attempted to manipulate many forms, then that's not something you would brag about.

Anyways, injection tactics are the same across SQL databases, for the most part.

 

[Rotana]

Take a look to this

To view the content, you need to sign in or register

 

[Guy]

Take a look to this

To view the content, you need to sign in or register

The $banlist is very restricting, linking to a problem I referenced earlier in this thread, and the other portion is already used in this thread.

"a look"?

 

[Solaire]

Take a look to this

To view the content, you need to sign in or register

That's almost the same as gWX0 posted.

 

[iceman4154]

I use this one.

function antisql($sql)
{
  $sql = htmlspecialchars($sql);
  $sql = str_replace("'", '& #039;', $sql);
  $sql = str_replace('"', '&quote;', $sql);

  return $sql;
}

~Iceman

 

[Alkyron]

I use this one.

function antisql($sql)
{
  $sql = htmlspecialchars($sql);
  $sql = str_replace("'", '& #039;', $sql);
  $sql = str_replace('"', '&quote;', $sql);

  return $sql;
}

~Iceman

Its works ?

 

[Jackbush]

Don't forget to include the sanitize_data function in whatever script is calling it!

 

[Zephyr]

That one clearly sucks. It blocks any slash, dot, comma, and so forth. Just clean ', " and \.

i don't know why the user even should be allowed slash, dot or comma...
a-z A-Z 0-9 - and _ should be enough for most of us...

also if you do it on "exclude" list then be sure to get rid of lineswitches also although i'm pretty sure that's not something that you usually get from inputfield lol...