Iframe Injection

[ewanz]

hello.. my site just got iframe injection... who know to how to prevent it happen from hacker?

[subzero]

if(preg_match("(<script|<about|<applet|<iframe|<activex|<chrome|<object|>|<|<a|<img|/>|;|')", $message)) {  
$message = 'Contains illegal tags.';  
}

[Mysterio]

How to use this code, SubZero (may i call you UnderZero :p ) ?

[subzero]

change $message with your text or main script

[CreativityKills]

Gud stuff sub bt in reality those regular expression can be bypassd easy by a lil sense. Just use htmlentities or htmlspecialchars or to be completely sure strip_tags. If u must use regex or sumtin wateva, specify whitelist NEVER blacklist.

[ewanz]

if(preg_match("(<script|<about|<applet|<iframe|<activex|<chrome|<object|>|<|<a|<img|/>|;|')", $message)) {  
$message = 'Contains illegal tags.';  
}

Just put these codes in part for shout, chat, pm, and post forum.. is it true?

[ewanz]

Gud stuff sub bt in reality those regular expression can be bypassd easy by a lil sense. Just use htmlentities or htmlspecialchars or to be completely sure strip_tags. If u must use regex or sumtin wateva, specify whitelist NEVER blacklist.

This iframe injection were posted by some malwares or malicious codes bypass ftp from the pc.. is it true?

[ewanz]

i clear all my scripts in file manager.. then i changed the ftp, database n cpanel password, that iframe not come again in my script...

[subzero]

you can use it for file host or anything to do with input

[ewanz]

you mean put anywhere in part of text post?

[subzero]

as long you change $message to you want it to be

[ewanz]

$shtxt = $shtxt;
if(preg_match("(<script|<about|<applet|<iframe|<ac tivex|<chrome|<object|>|<|<a|<img|/>|;|')", $shtxt)) {
$shtxt = 'Contains illegal tags.';
}
//$uid = getuid_sid($sid);
$shtm = time();
$res = mysql_query("INSERT INTO ibwf_shouts SET shout='".$shtxt."', shouter='".$uid."', shtime='".$shtm."'");
if($res)

i change it... is it right?

[blackhowk]

Preventing SQL Injection with PHP

When you start working with dynamic websites, and therefore the use of data retreaved from a database, you always want to make sure your script is safe. $_POST and $_GET variables are simply to adjust in scripts and url's. Prevent SQL Injection by using a script like thisone. It checks whether the magic_quotes_gpc is enabled or not. If it is, it won't have to add the escaping slashes in front of each qoute or double quote. You don't want 2 slashes in front of it when it is enabled.

function:
[COLOR=#000000][COLOR=#0000BB]?php 
    [/COLOR][COLOR=#007700]function [/COLOR][COLOR=#0000BB]mysql_prepare[/COLOR][COLOR=#007700]( [/COLOR][COLOR=#0000BB]$value [/COLOR][COLOR=#007700]) { 
        [/COLOR][COLOR=#0000BB]$magic_quotes_active [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]get_magic_quotes_gpc[/COLOR][COLOR=#007700](); 
        [/COLOR][COLOR=#0000BB]$new_enough_php [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]function_exists[/COLOR][COLOR=#007700]( [/COLOR][COLOR=#DD0000]"mysql_real_escape_string" [/COLOR][COLOR=#007700]);  
        if( [/COLOR][COLOR=#0000BB]$new_enough_php [/COLOR][COLOR=#007700]) { [/COLOR][COLOR=#FF8000]// PHP v4.3.0 or higher 
            [/COLOR][COLOR=#007700]if( [/COLOR][COLOR=#0000BB]$magic_quotes_active [/COLOR][COLOR=#007700]) { [/COLOR][COLOR=#0000BB]$value [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]stripslashes[/COLOR][COLOR=#007700]( [/COLOR][COLOR=#0000BB]$value [/COLOR][COLOR=#007700]); } 
            [/COLOR][COLOR=#0000BB]$value [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]mysql_real_escape_string[/COLOR][COLOR=#007700]( [/COLOR][COLOR=#0000BB]$value [/COLOR][COLOR=#007700]); 
        } else { [/COLOR][COLOR=#FF8000]// before PHP v4.3.0 
            [/COLOR][COLOR=#007700]if( ![/COLOR][COLOR=#0000BB]$magic_quotes_active [/COLOR][COLOR=#007700]) { [/COLOR][COLOR=#0000BB]$value [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]addslashes[/COLOR][COLOR=#007700]( [/COLOR][COLOR=#0000BB]$value [/COLOR][COLOR=#007700]); } 
        } 
        return [/COLOR][COLOR=#0000BB]$value[/COLOR][COLOR=#007700];  
    } 
[/COLOR][COLOR=#0000BB]?>[/COLOR][/COLOR]

 example:
[COLOR=#000000][COLOR=#0000BB]<?php 
$id [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]mysql_prepare[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000BB]$_GET[/COLOR][COLOR=#007700][[/COLOR][COLOR=#DD0000]'id'[/COLOR][COLOR=#007700]]); 
[/COLOR][COLOR=#0000BB]$query [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#DD0000]"SELECT * FROM pages WHERE id = "[/COLOR][COLOR=#007700].[/COLOR][COLOR=#0000BB]$id[/COLOR][COLOR=#007700]; 
[/COLOR][COLOR=#0000BB]mysql_query[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000BB]$query[/COLOR][COLOR=#007700]); 
[/COLOR][COLOR=#0000BB]?>[/COLOR][/COLOR]

use this idea, works fine.

[CreativityKills]

i clear all my scripts in file manager.. then i changed the ftp, database n cpanel password, that iframe not come again in my script...

check ur db, myt have bin injected ages ago. And blackhowk ure wrng to use magic quotes in place of mysql escape. Magic q is by all means bypassable. Magic should be last resort. Check dis.

function dbParse($input){
if(magic_quotes_gpc())$input=stripslashes($input);
if(function_exists('mysql_real_escape_string')){
$input=mysql_real_escape_string($input);
}elseif(function_exists('mysql_escape_string')){
$input=mysql_escape_string($input);
}else{
$input=addslashes($input);
}
return $input;
} 

[blackhowk]

you're right, Gigs I think I rushed the explanation.