 |  |  |  |  |  |  |  |
How to secure my web
Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
 |
•
•
Join Date: Sep 2008
Posts: 176
Reputation: 
Solved Threads: 13
Junior Poster
It's very possible.
mysql_real_escape_string() only escapes special characters such as " and ' that can make your queries vulnerable to a MySQL injection. Inserting script into a query is not MySQL injection as it doesn't affect the database. The danger is when other people view a page that uses this content. The script can get cookies from the user such as password and username and send them to script on their site that saves them. To protect again this all you have to do is escape < and > with their HTML equivalents ( < and > ): PHP Syntax (Toggle Plain Text)
Last edited by FlashCreations; Aug 22nd, 2009 at 8:22 pm.
•
•
Join Date: Jun 2007
Posts: 1,227
Reputation:
Solved Threads: 167
Thats not sql injection. It's called xss.
You need to run the data through the php function htmlentities().
You need to run the data through the php function htmlentities().
Google is your friend.
Use [code] tags.
If you have found a solution to your problem, please mark the thread as SOLVED.
Use [code] tags.
If you have found a solution to your problem, please mark the thread as SOLVED.
•
•
Join Date: Mar 2008
Posts: 217
Reputation:
Solved Threads: 4
Posting Whiz in Training
thankx for your suggestions,i will work on it.
•
•
Join Date: Mar 2008
Posts: 217
Reputation:
Solved Threads: 4
Posting Whiz in Training
i tried
and htmlentities() they are doing the same thing.
Is the anything more i should take care of ???
php Syntax (Toggle Plain Text)
Is the anything more i should take care of ???
•
•
Join Date: Sep 2008
Posts: 176
Reputation:
Solved Threads: 13
Junior Poster
You probably should use htmlentities as it is a function that is packaged with PHP and therefore does a lot more then replace the < and >. In fact, htmlentities escapes all characters that have HTML "entity equivalents" (> or < for example). Since htmlentities does a lot more then my two str_replaces, I would use htmlentities. Off the top of my head, I can't think of anything else if you've tried something similar to my unique key system (and removed that cookie that stores the user's password!).
Last edited by FlashCreations; Aug 23rd, 2009 at 1:10 pm.
•
•
Join Date: Mar 2008
Posts: 217
Reputation:
Solved Threads: 4
Posting Whiz in Training
Is there a way someone could use GET OR REQUEST ,TO harm my site?
bcoz up to this moment,i were just dealing with the inputs POST.
bcoz up to this moment,i were just dealing with the inputs POST.
•
•
Join Date: Sep 2008
Posts: 176
Reputation:
Solved Threads: 13
Junior Poster
As long as you don't use the
$_GET[] variable without sanitizing or replacing html entities you should be safe. If you don't use it, there's no way for it to be hacked! •
•
Join Date: Mar 2008
Posts: 217
Reputation:
Solved Threads: 4
Posting Whiz in Training
AS i were still working with the security issue,through Google search i found one PHP CLASS which the input filters(GET,POST AND REQUEST).
HERE IS THE LINK
www.phpclasses.org/browse/package/2189.html
HERE IS THE LINK
www.phpclasses.org/browse/package/2189.html
|
Similar Threads
- Need a secure web conferencing appliance. (Site Layout and Usability)
- Cannot access any secure websites or log into MSN (Viruses, Spyware and other Nasties)
- Creating Web Proxy Servers in Visual Basic (IT Professionals' Lounge)
- DNS Error for Secure Web Sites only (Web Browsers)
- I cannot access any secure web sites (Web Browsers)
- Cannot Access a Single WEB Site (Web Browsers)
- Web server at home - ethernet router (Windows Servers and IIS)
Other Threads in the PHP Forum
- Previous Thread: PhoneBook Script [Project]
- Next Thread: Images made from Blob are Cut Off
| Thread Tools | Search this Thread |
You need to join our community in order to build your list of favorite forums. You can visit the forum index for a listing of all forums.
Related Forum Features
Latest PHP Posts
- Today's Posts
- Unanswered Threads
apache api array basic beginner binary broken cache cakephp checkbox class cms code computing confirm cron curl customizableitems database date delete display dynamic echo email error external file files filter folder form forms forum function functions gc_maxlifetime google headmethod host howtowriteathesis href htaccess html iframe image include insert ip javascript joomla limit link login mail malfunction memmory memory menu mlm multiple mysql navigation oop parsing paypal pdf php phpmysql problem query question radio random recursion remote script search select server sessions sms snippet source space sql syntax system table thesishelp trouble tutorial update upload url validator variable video web youtube
