Learn sql injection

[amylee]

i am working on securing lavaliar, blocking the holes in the script

lol ****ing good luck, i know how many holes there are in the script and believe me its a ****ing **** load i am talking 25 plus ways to **** with the script

thats one of the reasons why i dont update my script or even use it anymore

[paramound]

i am working on securing lavaliar, blocking the holes in the script

[makvanpor2000]

Thanks, i know things to do already

[paramound]

makvanpor this is the best option for your site, just remrove your broadcast, and direct uploading of pic intoa profile let it come through the file share.

[manavworld]

Than hw we can protact our site from hacking? ..and whr i can put this code...mysql_real_escape_string(strip_tags....i wana to protact my site only to sql injection...hw i can do it...plz help me...plz

[CreativityKills]

Lmao, sql injection simply means: i dnt need ur password to **** with ur application lmao

[manavworld]

Whts sql_injection, its a reason 4 hack our site? Wot we can do for security of our site, last day sm1 hack mah site, and may be he used mah pasword also, hw is it posible even i was change my pasworld last evening? Am very confused about it, can any one tell me how to that hacker enter mah site nd how he get mah pasword?

[makvanpor2000]

don't hack back since you are a new coder, just chillout. Hacking is bad just learn preventive measures

u better dont deviate from the topic cause am not a new bie here as u can see am a senior member here,

[metulj]

Prevention from Sql Injection Attack in PHP

To avoid the sql injection attack, please follow the following simple mechanisms in PHP

1) Always restrict the length of the fields of form such as don’t allow more than 20 characters in the fields like username and password with the “maxlength” property available in the html form.

2) Always validate for the proper input like weather the value is valid email or not, is numeric or not , valid date or not etc.

3) Finally, Always use mysql_real_escape_string() function before sending the variable to the SQL query, it ad. For example
note you must be connected to the database for using this function

$username=mysql_real_escape_string($_POST['username']);
$password=mysql_real_escape_string($_POST['password']);

@$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
@$password = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['password']))); 

this should be pretty much better

[youngbobby]

Hi thanks for the help. It was really helpful. But if u have time, u can also tutor on how to validate email field apart from using mysql_real_escape_string(); function

[ranzit2]

where do i need to put that htaccess?
i mean the .htaccess file

in the folder where ur script is.

[kei_ki7]

Prevention from Sql Injection Attack in PHP

$username=mysql_real_escape_string($_POST['username']);
$password=mysql_real_escape_string($_POST['password']);

# Block out any script trying to set a mosConfig value through the URL

RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]

# Block out any script trying to base64_encode crap to send via URL

RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]

# Block out any script that includes a <script> tag in URL

RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]

# Block out any script trying to set a PHP GLOBALS variable via URL

RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

# Block out any script trying to modify a _REQUEST variable via URL

RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

# Send all blocked request to homepage with 403 Forbidden error!

RewriteRule ^(.*)$ index.php [F,L]

where do i need to put that htaccess?
i mean the .htaccess file

[GiLL]

Prevention from Sql Injection Attack in PHP

To avoid the sql injection attack, please follow the following simple mechanisms in PHP

1) Always restrict the length of the fields of form such as don’t allow more than 20 characters in the fields like username and password with the “maxlength” property available in the html form.

2) Always validate for the proper input like weather the value is valid email or not, is numeric or not , valid date or not etc.

3) Finally, Always use mysql_real_escape_string() function before sending the variable to the SQL query, it ad. For example
note you must be connected to the database for using this function

$username=mysql_real_escape_string($_POST['username']);
$password=mysql_real_escape_string($_POST['password']);

if a intruder inject ‘ OR 1 in the user name and password field then the value of the $username and $password will become \’ OR 1 which is not going to harm us anymore.



this might also help some one
.htaccess

# Block out any script trying to set a mosConfig value through the URL

RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]

# Block out any script trying to base64_encode crap to send via URL

RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]

# Block out any script that includes a <script> tag in URL

RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]

# Block out any script trying to set a PHP GLOBALS variable via URL

RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

# Block out any script trying to modify a _REQUEST variable via URL

RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

# Send all blocked request to homepage with 403 Forbidden error!

RewriteRule ^(.*)$ index.php [F,L]

[paramound]

don't hack back since you are a new coder, just chillout. Hacking is bad just learn preventive measures

[opticalpigion]

the reason why i bring up this topic cos some one is hacking into my database, and i want to hack back into his

RewriteCond %{QUERY_STRING} [^a-z](declare|char|set|cast|convert|delete|drop|exec|insert|meta|script|select|truncate|update)[^a-z] [NC] 
RewriteRule (.*) - [F]

add this into ur .htaccess