SQL Hack

[frostymarvelous]

Don't forget your cookies, and useragents.. Useragents especially are used Cos ppl tend to forget that they are also user input.

[sm4rtgl0b3]

Clean your post and get method., its simple and you dont have any problem of sqli by that.,

[icen01]

Thankz for some info, tnt,..

[ewanz]

bef0re this i had used cleanQuery like 0zzie had p0sted in t0pic.. I put f0r all get, p0st and request t0 secure fr0m injecti0n... N0w, is it i must rem0ve it n replace with the new 0ne..

[rayjee]

thanks all the inf0.. I will try it..

Added after 5 minutes:

thanks mate.. That mean i must str replace all the bad c0de f0r the br0wser..

yup friend. . Put the mysql_real_escape(). . . . . UPDATE ubr and ip . .Tnx to Wap metal f0r teach me how to secured dat injecti0n. .

[GiLL]

he is not injecting from browser he is injecting from edit profile like where you change your password and user name etc he put query there and update all users name or password etc

[firemax]

In some cases hacker does not know the name of the table or the column names, but he can use the same techniques to find these out.

He need to find out the name of the database that you are using. The function DATABASE() will give you that value. When he know the name of the database being used he can take guesses at the names of the tables.

Does the current database contain the letter j?

' OR EXISTS(SELECT 1 FROM dual WHERE database() LIKE '%j%') AND ''='

Is there a table called one in database test?

' OR EXISTS(SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='test' AND TABLE_NAME='one') AND ''='

Is there more than one table in the database(s) containing a j?

 ' OR (SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA LIKE '%j%')>1 AND ''='

[ewanz]

thanks all the inf0.. I will try it..

Added after 5 minutes:

thanks mate.. That mean i must str replace all the bad c0de f0r the br0wser..

[robzky]

lol. . . . . . . . . .

much better to quite lol! hehe,

[rayjee]

noob suggestion. if you want to learn how to secure such script, go to school and study PHP/SQL.. LOL

lol. . . . . . . . . .

[wapxtech]

the best way to secure it, run any ftp client something like FileZilla, login your ftp account. righclick your public_html dir. and delete it.. xD

~CREDITS TO GUMSLONE.

M8 Its me yggrassil hehe. Heres the tip, u must secured ur browser =)

noob suggestion. if you want to learn how to secure such script, go to school and study PHP/SQL.. LOL

[something else]

This was only a quick fix to most problems ... i said use addslashes as i said put it in config.php .... which is before database connecting as you cant use mysql_real_escape_string due to no connection to database...

[CreativityKills]

Okay it wont work because sum1 who knws half of what hes doing wnt cum at u with dat test u did. Btw u shud really ditch addslashes man

Added after 2 minutes:

And oh if u are using what my man posted up there, atleast filter ur cookies and server globals, we dnt want anyfin cumin frm there now do we.

[rayjee]

m8

M8 Its me yggrassil hehe. Heres the tip, u must secured ur browser =)

[something else]

You say that about all my coding :P and also then never say why it wont work ..... SO heres a test...

4 of the above tests:
before code:
test1: ', id='<script>
test2: ', id='<script>
test3: ', id='<script>
test4: ', id='<script>

after code:
test1: \', id=\'&lt;script&gt;
test2: \', id=\'&lt;script&gt;
test3: \', id=\'&lt;script&gt;
test4: \', id=\'&lt;script&gt;

Now can you tell me why its not going to work? ... you probably wont answer me as per usual lol