dezkit Posted August 10, 2008 Share Posted August 10, 2008 can somebody tell me all the functions to remove sql injections Quote Link to comment Share on other sites More sharing options...
Jabop Posted August 10, 2008 Share Posted August 10, 2008 escaping Quote Link to comment Share on other sites More sharing options...
dezkit Posted August 10, 2008 Author Share Posted August 10, 2008 moar Quote Link to comment Share on other sites More sharing options...
cooldude832 Posted August 10, 2008 Share Posted August 10, 2008 there aren't magic functions to remove injection capabilities it is writing quality scripts that can't be exploited Quote Link to comment Share on other sites More sharing options...
deadlyp99 Posted August 10, 2008 Share Posted August 10, 2008 OK man, you have some serious googling to do. As a former aspiring "hacker" I am telling you the best way to learn to prevent them, is to learn how the hell they work and how to use them. Steer your browser towards hackthissite.org and hellboundhackers.org. Both have basically the same web challenges, but different takes. So you may have a harder time on the same type of challenge on the different site. In addition, read all the member articles, and the forums helping on the challenges (which will point you towards many other resources). Oh and this is a free community forum, don't demand things because your not paying anyone for the information, we are just kind enough to help. Also there are instances where escaping code won't do the trick, I can't really give specifics. Cracking/security is like art. Every new case is unique and special. Its why I love programming so much. There is a thousand different ways to code things, and every programmer has his own unique footprint. Strengths and weaknesses. You will undoubtedly have some, so read up on all areas of security and web cracking, because while the applications you code may have tighter security than a bank vault, if the floor underneath has a public access shaft, then you'll find your things gone. Security takes more than the code, though thats the first thing people will look for as its one of the most common human errors, the applications that actually run your code need to be secure as well. The OS, web server, mysql server, etc etc Have a good day PS: I love security theory EDIT: and cooldude832 remove "can't be exploited" from your vocabulary, that is a fiction thing and simply does not exist. All things can be exploited, it just takes different levels of ingenuity, skill, and intuition, and most importantly... time. Quote Link to comment Share on other sites More sharing options...
cooldude832 Posted August 10, 2008 Share Posted August 10, 2008 not true you can write to not be exploited. You can be cracked but not exploited. Differences Quote Link to comment Share on other sites More sharing options...
deadlyp99 Posted August 10, 2008 Share Posted August 10, 2008 No no no. You can code to not be exploited, sure. But never know if some Stephen Hawking brainchild cracker has found an error in a command as simple as echo or something. And believe me its not outside the realm of possibility. So the lesson is you can code to not be exploited with things you already know can be exploited, as well as some things that have the possibility to be exploited. Being cracked or exploited mean basically the same thing, but if you mean cracking a password algorithm, then yes they are different. I was referring to cracking as the term "hacking" is commonly improperly used as, though I guess political correctness doesn't really matter at all Exploiting a whole is like a tool in a crackers arsenal in the way I see the term. However lets not get in a debate on the forum, I've done way to many of those and I'd rather spend my time playing a video game or something. If you want to take it further, shoot me a pm. I don't want to make any enemies, but I did call you out didn't I? >< Damn lol. Lets instead focus on educating this guy, or at least giving him the resources to do so. Quote Link to comment Share on other sites More sharing options...
cooldude832 Posted August 10, 2008 Share Posted August 10, 2008 that is finding a way to get around in the base of the language that every single script written in php would be at risk for. That is not hacking your specific script. If you are witting a script that needs to have a level of security that would draw attention of world class hackers I doubt you should be witting it if you have to ask questions on a help forum. Quote Link to comment Share on other sites More sharing options...
dezkit Posted August 11, 2008 Author Share Posted August 11, 2008 hey guys, sorry that i didn't reply, but i just wanted the commands like mysql_real_escape_string Quote Link to comment Share on other sites More sharing options...
dezkit Posted August 11, 2008 Author Share Posted August 11, 2008 bump lol Quote Link to comment Share on other sites More sharing options...
corbin Posted August 11, 2008 Share Posted August 11, 2008 addslashes mysql_real_escape_string Those would work just fine to prevent SQL injection with MySQL. (Don't use both.) Quote Link to comment Share on other sites More sharing options...
DarkWater Posted August 11, 2008 Share Posted August 11, 2008 addslashes mysql_real_escape_string Those would work just fine to prevent SQL injection with MySQL. (Don't use both.) Actually, the latter is the one you should use because addslashes() doesn't cover every character that'll cause issues for MySQL. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.