 |  |  |  |  |  |  |  |
How to secure my web
Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
 |
•
•
Join Date: Sep 2008
Posts: 184
Reputation: 
Solved Threads: 15
Junior Poster
It's very possible.
mysql_real_escape_string() only escapes special characters such as " and ' that can make your queries vulnerable to a MySQL injection. Inserting script into a query is not MySQL injection as it doesn't affect the database. The danger is when other people view a page that uses this content. The script can get cookies from the user such as password and username and send them to script on their site that saves them. To protect again this all you have to do is escape < and > with their HTML equivalents ( < and > ): PHP Syntax (Toggle Plain Text)
Last edited by FlashCreations; Aug 22nd, 2009 at 8:22 pm.
•
•
Join Date: Jun 2007
Posts: 1,227
Reputation:
Solved Threads: 167
Thats not sql injection. It's called xss.
You need to run the data through the php function htmlentities().
You need to run the data through the php function htmlentities().
Google is your friend.
Use [code] tags.
If you have found a solution to your problem, please mark the thread as SOLVED.
Use [code] tags.
If you have found a solution to your problem, please mark the thread as SOLVED.
•
•
Join Date: Mar 2008
Posts: 217
Reputation:
Solved Threads: 4
Posting Whiz in Training
thankx for your suggestions,i will work on it.
•
•
Join Date: Mar 2008
Posts: 217
Reputation:
Solved Threads: 4
Posting Whiz in Training
i tried
and htmlentities() they are doing the same thing.
Is the anything more i should take care of ???
php Syntax (Toggle Plain Text)
Is the anything more i should take care of ???
•
•
Join Date: Sep 2008
Posts: 184
Reputation:
Solved Threads: 15
Junior Poster
You probably should use htmlentities as it is a function that is packaged with PHP and therefore does a lot more then replace the < and >. In fact, htmlentities escapes all characters that have HTML "entity equivalents" (> or < for example). Since htmlentities does a lot more then my two str_replaces, I would use htmlentities. Off the top of my head, I can't think of anything else if you've tried something similar to my unique key system (and removed that cookie that stores the user's password!).
Last edited by FlashCreations; Aug 23rd, 2009 at 1:10 pm.
•
•
Join Date: Mar 2008
Posts: 217
Reputation:
Solved Threads: 4
Posting Whiz in Training
Is there a way someone could use GET OR REQUEST ,TO harm my site?
bcoz up to this moment,i were just dealing with the inputs POST.
bcoz up to this moment,i were just dealing with the inputs POST.
•
•
Join Date: Sep 2008
Posts: 184
Reputation:
Solved Threads: 15
Junior Poster
As long as you don't use the
$_GET[] variable without sanitizing or replacing html entities you should be safe. If you don't use it, there's no way for it to be hacked! •
•
Join Date: Mar 2008
Posts: 217
Reputation:
Solved Threads: 4
Posting Whiz in Training
AS i were still working with the security issue,through Google search i found one PHP CLASS which the input filters(GET,POST AND REQUEST).
HERE IS THE LINK
www.phpclasses.org/browse/package/2189.html
HERE IS THE LINK
www.phpclasses.org/browse/package/2189.html
|
Similar Threads
- Need a secure web conferencing appliance. (Site Layout and Usability)
- Cannot access any secure websites or log into MSN (Viruses, Spyware and other Nasties)
- Creating Web Proxy Servers in Visual Basic (IT Professionals' Lounge)
- DNS Error for Secure Web Sites only (Web Browsers)
- I cannot access any secure web sites (Web Browsers)
- Cannot Access a Single WEB Site (Web Browsers)
- Web server at home - ethernet router (Windows Servers and IIS)
Other Threads in the PHP Forum
- Previous Thread: PhoneBook Script [Project]
- Next Thread: Images made from Blob are Cut Off
| Thread Tools | Search this Thread |
You need to join our community in order to build your list of favorite forums. You can visit the forum index for a listing of all forums.
Related Forum Features
Latest PHP Posts
- Today's Posts
- Unanswered Threads
301 apache api array autosuggest beginner beneath binary broadband broken button cakephp checkbox class cms code compression countingeverycharactersfromastring crack cron curl database date decode display dynamic echo email error file files folder form forms function functions google href htaccess html httppost image include insert integration ip javascript joomla limit link links login mail match md5 menu mlm multiple mysql mysql_real_escape_string oop paypal pdf php problem protocol query radio random recursion remote script search searchbox server session sessions sms smtp source space sql strip_tags survey syntax system table tutorial undefined update upload url validator variable video virus votedown web window.onbeforeunload=closeme; youtube
