Lavalair Sql Injection Blocker

[Mysterio]

how to stop sql blocking when some one comes and makes a external link to avatar, forum posts. how to stop that?

try to make something like go.php, so when someone adds a link, it will loose everything in there, then redirect to the desired url.

[murshid7]

how to stop sql blocking when some one comes and makes a external link to avatar, forum posts. how to stop that?

[kenxyz]

Where do i use d script

[kiLLeR-eyEd_14]

function safe($text)
{
$safe = stripslashes($text);
if(function_exists("mysql_real_escape_string"))
{
$safe = mysql_real_escape_string($safe);
}else if(function_exists("mysql_escape_string"))
{
$safe = mysql_escape_string($safe);
}
return $safe;
} 

use:
$str = safe($_POST['str']);
$str = safe($_GET['str']);

[Ponick]

Post this in your core.Php

function check_injection()
  {
    $badchars = array("DROP", "SELECT", "UPDATE", "DELETE", "DELETE" , "UNION", "WHERE", "FROM");
  
    foreach($_REQUEST  as $value)
    {
      if(in_array(strtoupper($value), $badchars))
      {
      $logfile= 'log/log.txt'; //chmod 777
$IP = $_SERVER['REMOTE_ADDR'];
$logdetails= date("F j, Y, g:i a") . ': ' . '<a href=http://dnsstuff.com/tools/city.ch?ip='.$_SERVER['REMOTE_ADDR'].' target=_blank>'.$_SERVER['REMOTE_ADDR'].'</a>';
$fp = fopen($logfile, "r+");
fwrite($fp, $logdetails, strlen($logdetails));
fclose($fp);

       header('Location:http://go-to-hell.com');

      }
      else
      {
        $check = preg_split("//", $value, -1, PREG_SPLIT_OFFSET_CAPTURE);
        foreach($check as $char)
        {
         if(in_array(strtoupper($char), $badchars))
          {
      $logfile= 'log/log.txt';
$IP = $_SERVER['REMOTE_ADDR'];
$logdetails= date("F j, Y, g:i a") . ': ' . '<a href=http://dnsstuff.com/tools/city.ch?ip='.$_SERVER['REMOTE_ADDR'].' target=_blank>'.$_SERVER['REMOTE_ADDR'].'</a>';
$fp = fopen($logfile, "r+");
fwrite($fp, $logdetails, strlen($logdetails));
fclose($fp);

            header('Location:http://go-to-hell.com');
     }
    }
   }
  }
  } 

hehehe. . .

[kiss]

function clean($str)
{
$str = @trim($str);
if(get_magic_quotes_gpc())
{
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
} 

Easy and very usefull:
$test = clean($_REQUEST['test']);
$test = clean($_POST['test']);
$test = clean($_GET['test']);

[newbie14]

re

ini_set("display_errors", "0");
if(!get_magic_quotes_gpc())
{
$_GET = array_map('trim', $_GET);
$_POST = array_map('trim', $_POST);
$_COOKIE = array_map('trim', $_COOKIE);

$_GET = array_map('addslashes', $_GET);
$_POST = array_map('addslashes', $_POST);
$_COOKIE = array_map('addslashes', $_COOKIE);
}

its true prevent sql inject?

[Pablo]

yes it is in core.php

[riderz]

i think that comes in core.php

[cedwap]

where to put that?

[spiderwebs]

I Uses this when i used to use lavalair

ini_set("display_errors", "0");
if(!get_magic_quotes_gpc())
{
$_GET = array_map('trim', $_GET);
$_POST = array_map('trim', $_POST);
$_COOKIE = array_map('trim', $_COOKIE);

$_GET = array_map('addslashes', $_GET);
$_POST = array_map('addslashes', $_POST);
$_COOKIE = array_map('addslashes', $_COOKIE);
} 

[xcoderx]

Tht dnt stop hacking lol

[kiss]

//protect against sql injections and remove $ sign
if( !get_magic_quotes_gpc() )
{
    if( is_array($_GET) )
    {
        while( list($k, $v) = each($_GET) )
        {
            if( is_array($_GET[$k]) )
            {
                while( list($k2, $v2) = each($_GET[$k]) )
                {
                    $_GET[$k][$k2] = addslashes($v2);
                }
                @reset($_GET[$k]);
            }
            else
            {
                $_GET[$k] = addslashes($v);
            }
        }
        @reset($_GET);
    }

    if( is_array($_POST) )
    {
        while( list($k, $v) = each($_POST) )
        {
            if( is_array($_POST[$k]) )
            {
                while( list($k2, $v2) = each($_POST[$k]) )
                {
                    $_POST[$k][$k2] = addslashes($v2);
                }
                @reset($_POST[$k]);
            }
            else
            {
                $_POST[$k] = addslashes($v);
            }
        }
        @reset($_POST);
    }
} 

this is 1 code found ;)

or how about:

<?php
if (get_magic_quotes_gpc()) 
{
    $in = array(&$_GET, &$_POST, &$_COOKIE);
    while (list($k,$v) = each($in)) 
    {
        foreach ($v as $key => $val) 
        {
            if (!is_array($val)) 
            {
                $in[$k][$key] = stripslashes($val);
                continue;
            }
            $in[] =& $in[$k][$key];
        }
    }
    unset($in);
}
?>

[ori]

i use

function get_var($var)
{
$myvar=$_REQUEST["$var"];
if(is_array($myvar))$var=$myvar[0];
else $var=htmlspecialchars(trim($_REQUEST["$var"]),ENT_QUOTES);
return $var;
} 

for data posted to mysql or to a string that way when data is called it wont be passed for special characters again as this would cause probs lol

[ozziemale31]

to protect your file share folders from php pages being uploaded make a htaccess page and put in it the following

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>

<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>

<Files images>
deny from all
</Files>

<Files *.php>
deny from all
</Files>

<Files *.php.*>
deny from all
</Files>

<Files *.php.php.*>
deny from all
</Files> 

when a php page is uploaded in that directory and the hacker goes to open it they end up with a nice 403 error page not found even though their script to hack may be there lol thanks to gum for that lil trick