SQL Hack

[CreativityKills]

Dats nt actually guna do anyfin.

[something else]

i have 4 times change the table name but it same happened like robzsky.. I also have put many anti sql in my script..why it still g0t hacked by injecti0n?

This is pointless if your not correctly protected as sql can be crashed easily to give out your new table names

You still have holes in your site use the below code and it will fix them:

This will stop the 2 main holes you are not protecting:
Add this to your config.php

if(isset($_GET)){foreach($_GET as $key=>$value){$_GET[$key]=addslashes(htmlspecialchars($value));}}
if(isset($_POST)){foreach($_POST as $key=>$value){$_POST[$key]=addslashes(htmlspecialchars($value));}}   
if(isset($_SERVER)){foreach($_SERVER as $key=>$value){$_SERVER[$key]=addslashes(htmlspecialchars($value));}} 
if(isset($_SESSION)){foreach($_SESSION as $key=>$value){$_SESSION[$key]=addslashes(htmlspecialchars($value));}} 

[ewanz]

i have 4 times change the table name but it same happened like robzsky.. I also have put many anti sql in my script..why it still g0t hacked by injecti0n?

[something else]

simply.. Just rename all your table name.. for ex.
from ibwf_users
to 7awt534_user
lol..
open a text editor.. and replace IBWF to (desire name of table) make sure that all of the php file changed!

This is pointless if your not correctly protected as sql can be crashed easily to give out your new table names

[subzero]

pmpl, This is why i banned the noob ...

Also Note your using lavalair and yes its full of bugs you can't fix it pay a pro coder for a script that works ok

[robzky]

Damn! in my SQL ibwf_users.. Registered username a lot of fake1, fake02, fake03............fake10000000 users!

[leadiztah]

simply.. Just rename all your table name.. for ex.
from ibwf_users
to 7awt534_user
lol..
open a text editor.. and replace IBWF to (desire name of table) make sure that all of the php file changed!

[crazybrumi]

this looks to be huwards doing again. he tries geting in via your puting some code in the user agent which if u havnt got htmlchars or mysql_real_escape will execute anything in the database you ask it to.

[robzky]

Where he input that injection?

[subzero]

More like xml injection but my little code will block them doing it to you..

[robzky]

Okay thanks dude, well, How did the hackers that?
what kind of sql injection he used?

[subzero]

Open my username (subzero) search anti sql injection then do what it says

Enjoy!

[robzky]

My site hacked,
In my SQL ibwf_users all password are the same.
Hacker can use any members username in my site.
How does it happen?
And
How to prevent this kind of hacking?