How to secure my web

Reply

Join Date: May 2008
Posts: 23
Reputation: Besherek is an unknown quantity at this point 
Solved Threads: 0
Besherek Besherek is offline Offline
Newbie Poster

Re: How to secure my web

 
0
  #11
Aug 19th, 2009
Interesting thread ....

Does this work as well?

  1.  
  2. $a_user=$_POST['login_username'];
  3. $a_password=sha1($_POST['login_password']);
  4.  
  5. // set up SQL statement
  6. $query = sprintf("SELECT *
  7. FROM admin_auth
  8. WHERE a_user = '%s'
  9. AND a_pass = '%s'",
  10. mysql_real_escape_string($a_user),
  11. mysql_real_escape_string($a_password));
Reply With Quote Quick reply to this message  
Join Date: Mar 2008
Posts: 217
Reputation: mrcniceguy is an unknown quantity at this point 
Solved Threads: 4
mrcniceguy mrcniceguy is offline Offline
Posting Whiz in Training

Re: How to secure my web

 
0
  #12
Aug 19th, 2009
Sometimes i have feelingz may be something is wrong with the server i`m hosting my website.
How do you guys think??
Reply With Quote Quick reply to this message  
Join Date: Sep 2008
Posts: 197
Reputation: FlashCreations is an unknown quantity at this point 
Solved Threads: 17
FlashCreations's Avatar
FlashCreations FlashCreations is offline Offline
Junior Poster

Re: How to secure my web

 
0
  #13
Aug 19th, 2009
Well, it doesn't appear anything is wrong. (I do agree, you should use mysql_real_escape_string() in your registration script too). I must say, it is a huge security flaw to save passwords and other sensitive data in a SESSION variable. It would be much better if you have each user a unique key that changed every few minutes and stored that in a SESSION variable instead of the password. Since you code looks fine to me, what errors/problems are you seeing with this script?
FlashCreations
(aka PhpMyCoder)

About Me | My Blog | Contact Me
Reply With Quote Quick reply to this message  
Join Date: Mar 2008
Posts: 217
Reputation: mrcniceguy is an unknown quantity at this point 
Solved Threads: 4
mrcniceguy mrcniceguy is offline Offline
Posting Whiz in Training

Re: How to secure my web

 
0
  #14
Aug 19th, 2009
the error i`m seeing in this script is
  1. }else{
  2. include"wronglogin.php";//the wrong login
  3. }
i also added in mysql_real_escape_string() in the registration and it gave me one error. see my registration code below
  1. <?php
  2. $name=$_POST['name'];
  3. $user=$_POST['user'];
  4. $email=$_POST['email'];
  5. $country=$_POST['country'];
  6. $passreal=$_POST['password2'];
  7. $password=md5($_POST['password']);
  8. $password2=md5($_POST['password2']);
  9. $location=$_POST['location'];
  10. $family=$_POST['family'];
  11. $names="$name $family";
  12. $age=$_POST['age'];
  13. $gender=$_POST['gender'];
  14. $relation=$_POST['relation'];
  15. $agree=$_POST['agree'];
  16. //check if username contains space
  17. if(false !== strpos($user, ' '))
  18. { echo '<font color=brown>Sorry, the username should not contain any spaces.</font></br>';
  19. echo"you can use the underscore (_) to separate</br> or the minus (-) sign.</br>";
  20. echo"<center><a href=sinup.php> < < BACK </a></center>";
  21. exit();
  22. }
  23. //check if username is greater than 25 character
  24. if (strlen($user)>20)
  25. {
  26. echo "<font color=brown>Length of username is too long!</font></br>";
  27. echo"it should not be longer than 20 characters<br>";
  28. echo"<center><a href=sinup.php> < < BACK </a></center>";
  29. exit();
  30. }
  31. //check if email is valid
  32. function isEmail($email) {
  33. return preg_match('/^[-0-9A-Z_\.]{1,50}@([-0-9A-Z_\.]+\.){1,50}([0-9A-Z]){2,4}$/i', $email);
  34. }
  35. $err = '';
  36. if ( !isEmail($_POST['email']) ) $err .= '<font color=brown>Your Email address must be valid!<br/><a href=sinup.php> < < BACK </a> </font>';
  37.  
  38. if ($err){ echo $err;
  39. exit();
  40.  
  41. }
  42. //check if all datas where posted.
  43. if(!$name||!$password||!$family||!$country||!$user||!$email||!$location||!$relation||!$password2||!$gender||!$age){
  44. echo "<center><b><font color=blue size=>Fill all the required Fields.</font></b><br>";
  45. echo "<font color=blue >Go back and complete<br><a href=sinup.php><< BACK </a></font><br></center>";
  46. exit();
  47. }
  48.  
  49. if($password!=$password2){
  50. echo"<center><font color=brown>Password You gave does Not match</font></center>";
  51. echo"<center><form action=sinup.php method=post><input type=submit value='OKEY'></form></center>";
  52. exit();
  53. }
  54.  
  55. if(!$agree){
  56. echo"<font color=brown>you must agree the term of service to register</font>";
  57. exit();
  58. }
  59. ///connecting to databases
  60. include"config.php";
  61.  
  62. $check=mysql_query("SELECT user FROM login WHERE user='$user'");
  63. $rows=mysql_num_rows($check);
  64. if($rows==0){
  65. //$query="INSERT INTO login(name,family,male,female,user,email,country,password) VALUES('$name','$family','$male','$female','$user','$email','$country','$password')";
  66.  
  67. $query="INSERT INTO login SET name='$names',age='$age',location='$location',passreal='$passreal',relation='$relation',gender='$gender',user='$user',email='$email',country='$country',password='$password',date=CURDATE()";
  68. $prove="INSERT INTO profile SET names='$names',ages='$age',locations='$location',passreal='$passreal',relations='$relation',genders='$gender',users='$user',emails='$email',countrys='$country',passwords='$password',online='offline',dates=CURDATE()";
  69. $result=mysql_query($query,$dbcnx);
  70. $result1=mysql_query($prove,$dbcnx);
  71. if($result||$result1){
  72. echo"You registered successfully";
  73. }
  74. ?>
After adding mysql_real_escape_string() the error comes in
  1. //check if all datas where posted.
  2. if(!$name||!$password||!$family||!$country||!$user||!$email||!$location||!$relation||!$password2||!$gender||!$age){
  3. echo "<center><b><font color=blue size=>Fill all the required Fields.</font></b><br>";
  4. echo "<font color=blue >Go back and complete<br><a href=sinup.php><< BACK </a></font><br></center>";
  5. exit();
  6. }
which shows like i escaped some inputs.
Reply With Quote Quick reply to this message  
Join Date: Sep 2008
Posts: 197
Reputation: FlashCreations is an unknown quantity at this point 
Solved Threads: 17
FlashCreations's Avatar
FlashCreations FlashCreations is offline Offline
Junior Poster

Re: How to secure my web

 
0
  #15
Aug 19th, 2009
I don't think you understand where you are supposed to escape the string. The function should be used right before the variable is inserted into the database. This was if a user didn't fill out a field, they won't have to wait for the escaping of all the variables before they are validated (It could save a few milliseconds, but probably won't matter that much). Where you are getting the error, I would use:
  1. if(empty($name)||empty($password)||empty($family)||empty($country)||empty($user)||empty($email)||empty($location)||empty($relation)||empty($password2)||empty($gender)||empty($age)){
Last edited by FlashCreations; Aug 19th, 2009 at 6:53 pm.
FlashCreations
(aka PhpMyCoder)

About Me | My Blog | Contact Me
Reply With Quote Quick reply to this message  
Join Date: Mar 2008
Posts: 217
Reputation: mrcniceguy is an unknown quantity at this point 
Solved Threads: 4
mrcniceguy mrcniceguy is offline Offline
Posting Whiz in Training

Re: How to secure my web

 
0
  #16
Aug 19th, 2009
ok i will try it.
i`ll inform you.
Reply With Quote Quick reply to this message  
Join Date: Mar 2008
Posts: 217
Reputation: mrcniceguy is an unknown quantity at this point 
Solved Threads: 4
mrcniceguy mrcniceguy is offline Offline
Posting Whiz in Training

Re: How to secure my web

 
0
  #17
Aug 21st, 2009
hey guys!i came out with the solution..
the problem was with the Database connection.This function mysql_real_escape_string requires a database connection .
in my code i were establing the connection after the POST[].
Thankx all for Contribution.
Reply With Quote Quick reply to this message  
Join Date: Mar 2008
Posts: 217
Reputation: mrcniceguy is an unknown quantity at this point 
Solved Threads: 4
mrcniceguy mrcniceguy is offline Offline
Posting Whiz in Training

Re: How to secure my web

 
0
  #18
Aug 21st, 2009
@FlashCreations You talked about giving each user a unique key which will be changing every time.
how is it possible??
Reply With Quote Quick reply to this message  
Join Date: Sep 2008
Posts: 197
Reputation: FlashCreations is an unknown quantity at this point 
Solved Threads: 17
FlashCreations's Avatar
FlashCreations FlashCreations is offline Offline
Junior Poster

Re: How to secure my web

 
0
  #19
Aug 21st, 2009
Well for the users table in your MySQL database add a new column called session id. When the user logs in, create a long random string (unique key) to save as a cookie on the user's computer and in the user's row in the MySQL database (You would put it in the column you created for the unique keys). Then on every page where you authenticate the user, add code to create a new random string (unique key) and change the key in the cookie and the database to the new one you just created. This way you won't need to store a password in a cookie. You will only need to store the username and the unique key as a cookie on the user's computer (and add a column to your users table for the keys). To authenticate, check the username and the unique key and then regenerate the unique key.
Last edited by FlashCreations; Aug 21st, 2009 at 5:39 pm.
FlashCreations
(aka PhpMyCoder)

About Me | My Blog | Contact Me
Reply With Quote Quick reply to this message  
Join Date: Mar 2008
Posts: 217
Reputation: mrcniceguy is an unknown quantity at this point 
Solved Threads: 4
mrcniceguy mrcniceguy is offline Offline
Posting Whiz in Training

Re: How to secure my web

 
0
  #20
Aug 22nd, 2009
how is it possible that someone was able to insert Javascript in the database while i used mysql_real_escape_string
  1. <script>alert('helloo my friend')</script>
HOW CAN I AVOID THIS ISSUE??
my current code is
  1. $comment=mysql_real_escape_string($_POST['comment']);
I NEED YOUR HELP THIS ISSUE OF SQL INJECTION.
Reply With Quote Quick reply to this message  
Reply

This thread is more than three months old.
Perhaps start a new thread instead?
Message:



Similar Threads
Other Threads in the PHP Forum


Views: 1148 | Replies: 27
Thread Tools Search this Thread



Tag cloud for PHP
About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC