M2Raise.ml - PHP Platform! VERSION 1.0

Quote:

Originally Posted by K.A.K.A.S.H.I Hat bei mir ein Virus. [Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally Posted by Computerfreek Looks pretty suspicious. A nobody who releases a new homepage cms completely free which is strangely obfuscated by some weired "crypter". Without offending you I'd bet $5 that it contains some backdoors or at least security flaws somewhere in there which nobody can find.

Quote:

Originally Posted by Lord Metho Ich frage mich, was daran falsch ist...? Könntest du mir die "decompiled2 geben? Damit ich's selber beurteilen kann, denn die Argumente, die du bringst, entsprechen nur denen, die man beim !HEN bringt, also wieso ist !HEN besser?

Quote:

Originally Posted by Lord Metho OOP ist schon besser. Aber deswegen grade zu motzen ^^. Ich benutze eigentlich nur OOP, aber wem's nicht zusagt... Was du zu OpenSource sagst, da kann ich dir zustimmen, aber wenn du selbst in PHP Programmierst weisst du das es von der Struktur her, in den beiden Schnittstellen zu mysql einfach fast keinen Unterschied macht. Wenn man der Sch* eine goldenen Krone gibt, bleibt's Sch* mit einer goldenen Krone. (<- Ich finde jedoch, PDO ist auch nicht die Lösung). Ich will's mir aber zuerst angucken, bevor ich wirklich urteile. Das Gefühl sagt mir aber es ist ein "gemodetes" !HEN...

Quote:

Originally Posted by Mashkin PHP Code: // inc/func.core.php // ESCAPE A STRING BY REPLACING MALICIOUS CHARACTERS function escapeString($var) {     return str_replace(array('//', '\\', "\0", "\n", "\r", "'", '"', '\x1a', "<script>", "</script>",         "<script", ";","!", "#", "%", "&", "DROP", "INSERT", "ALTER", "SHUTDOWN", "UPDATE", "update",         "drop", "insert", "alter", "shutdown", "--", "\'\'"), "", $var); } // code/admin_connect.php $login = escapeString($_POST['login']); $query = mysql_query("SELECT * FROM ".ACCOUNT.".account WHERE login = '".$login."' AND password = PASSWORD('".$password."') AND web_admin > 0");  Notice the lack of secure input escaping, which will easily allow for an SQL injection vulnerability. Even the age-old mysql plugin has a proper escaping method, mysql_real_escape_string(). While in theory, your escaping method does the same thing (plus a bit more), it does not take into account certain implicit conversions that MySQL may do, most prominently to convert unicode quotation marks to local encoding quotation marks (read on [Only registered and activated users can see links. Click Here To Register...] and in [Only registered and activated users can see links. Click Here To Register...] OWASP presentation). MySQL's mysql_real_escape_string() knows how a string might be affected be implicit conversion, your filter doesn't. Even Hennink's code used proper escaping in most places, so it isn't wrong to assume his code is safer in this instance. Replacing all occurences of INSERT, UPDATE, etc. and insert, update, etc.is pointless, because InSeRt works just the same (SQL keywords are case-insensitive) and will slip through your filter. I won't rage on procedural style and using oldschool mysql plugin, I won't even talk about SQL prepared statements. Find some cheat sheets and recommendations, e.g. on OWASP, yourself.

function escapeString($var)
{
    return mysql_real_escape_string(str_replace(array('//', '\\', "\0", "\n", "\r", "'", '"', '\x1a', "<script>", "</script>", "<script", ";","!", "#", "%", "&", "DROP", "INSERT", "ALTER", "SHUTDOWN", "UPDATE", "update", "drop", "insert", "alter", "shutdown", "--", "\'\'"), "", $var));
}

Quote:

Originally Posted by Lord Metho No, you can use intern functions from PHP like strip_tag() htmlentities() htmlspecialchars() fgetss() or the opinion like htmlentities_decode() ...for a connexion with PDO = PDO::quote() <- A public function. To use it set a namespace.... You can also use prepared Arguments. But never use user-defined functions. There is also filter_var(_input) for Requests.

Quote:

Originally Posted by wildramen So the fact that i wanted to escape strings using a str_replace() is a bad idea. Then i should read more about this type of security before i'm in. It's pretty complicated and i am not very familiarised with the public namespaces and public functions. Thanks a lot! You rock! :cool:

<p class="comment"></p>

<p class="comment"><script>alert('XSS')</script></p>