skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 thats cool no biggie. also you could try protecting better against email spam if your worried I'm not worried about it, if it becomes a problem I could fix it with javascript, after using google a little, haha. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629498 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 Also, I have a page like insert.php but it has over 300 variables, so how could I do the if(!empty) function thing without having to type out all the variables? Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629772 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 there is not a way you would have to pass them all in the statement Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629846 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 that sucks...wait i just remembered that some of the fields for that form are always going to be left blank. I"ll put in all the other functions i put in insert.php, just not the !empty part....would it still be secure? Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629848 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 should be. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629878 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 alright thanks Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629884 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629898 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 these graphs are letting you know how dangerous using super globals are please try not to use these and turn them off in PHP Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629907 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 Which page is that from?? Which pages did I use them on? Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629912 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 insert.php i locally tested it on. please make sure superglobals is turned off on your script. i am sure you can google on how to not use them or turn them off in PHP Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629919 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 test it yourself here: http://pixybox.seclab.tuwien.ac.at/pixy/webinterface.php Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629933 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 I'm a bit confused...whats that link you gave me...because thats not the code for insert.php Also, if I turned off superglobals would that stop the script from working properly? Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629935 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 most likely what i amsaying is whoever coded the script used superglobals to code it with which isnt safe at all. i'd go bitch at them to secure it. and that was the wrong report but you can still run the code on that link i gave you and see for yourself. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629936 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 For insert.php i get this report http://pixybox.seclab.tuwien.ac.at/pixy/results.php?id=pixy_1220129868F9nqQM no vulnerabilities I'm confused as to what you are talking about...please point out where in insert.php I use a superglobal. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629941 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 I think you mean to say they're superglobals on admin.php. Because when I scan that they show up. If no one can access that page does it matter if there are superglobals? Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629943 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 that is weird i used the un edited version without all the sanitization must have had something to do with that. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629944 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 I think you mean to say they're superglobals on admin.php. Because when I scan that they show up. If no one can access that page does it matter if there are superglobals? Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629945 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 LOL i went back it was admin.php and i still can access admin.php i dont think you have disallowed the page Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629947 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 Haha, yeah. So, two questions. 1) If a turn off superglobals will the script still run properly, or will I have to edit it? 2) If I leave the code how it is, will it be fine, because no one else will be able to access the admin.php besides me? NOTE ** no, i haven't disallowed the page yet, i was going to use .htaccess but I'm having a little trouble figuring it out. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629949 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 1. no the script would not work you would have to overhaul it 2.) as long as i get a "sorry but this page is restricted" error when i access it , it should be safe. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629950 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 Alright, do you know any good pages for setting up .htaccess? Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629952 Share on other sites More sharing options...
darkfreaks Posted August 30, 2008 Share Posted August 30, 2008 http://www.yorku.ca/computng/students/webpages/central_web/htaccess.html Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629956 Share on other sites More sharing options...
skiingguru1611 Posted August 30, 2008 Author Share Posted August 30, 2008 great, i'll check it out thanks. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-629963 Share on other sites More sharing options...
darkfreaks Posted August 31, 2008 Share Posted August 31, 2008 nice you made your own 404 redirect according to zend: mysql_tablename and mysql_list_tables This function deprecated. It is preferable to use mysql_query() to issue a SQL SHOW TABLES [FROM db_name] [liKE 'pattern'] statement instead. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-630112 Share on other sites More sharing options...
skiingguru1611 Posted August 31, 2008 Author Share Posted August 31, 2008 What do you mean I made my own 404 redirect...I don't remember ever touching that. Also, what page was that error on from Zend? Admin.php is secure now. Link to comment https://forums.phpfreaks.com/topic/121497-test-security-please-non-destructive/page/4/#findComment-630123 Share on other sites More sharing options...
Recommended Posts