Stooney Posted November 4, 2008 Share Posted November 4, 2008 Referring to the firefox add-on. I'm new to it and don't quite understand the results. I'm testing a login form who's input only goes through mysql_real_escape_string. I thought that was enough to be safe. SQL Inject Me is giving some results like so: Server Status Code: 302 Found Tested value: 1' OR '1'='1 What exactly is the 302 error and what else do I need to aside from mysql_real_escape_string? Link to comment https://forums.phpfreaks.com/topic/131309-sql-inject-me/ Share on other sites More sharing options...
waynew Posted November 4, 2008 Share Posted November 4, 2008 A redirection probably happened as soon as it tested that value. Are you whitelisting and redirecting if the value is incorrect? Is the user brought to a new page when they post to this form? Link to comment https://forums.phpfreaks.com/topic/131309-sql-inject-me/#findComment-682088 Share on other sites More sharing options...
Stooney Posted November 4, 2008 Author Share Posted November 4, 2008 Upon clicking 'login' (which is located on index.php) the form is submitted to my login controller (http://site.com/login) which is where everything is processed and the user is either logged in or not. After all that there's a header("Location: ."site_url); site_url being 'http://site.com/'. So in short, they click login, it's processed and they're redirected back to index.php. (or technically the index controller in this case) Link to comment https://forums.phpfreaks.com/topic/131309-sql-inject-me/#findComment-682254 Share on other sites More sharing options...
waynew Posted November 4, 2008 Share Posted November 4, 2008 -> Form on index controller -> Form submission leads to login controller -> Login controller redirects back to index controller That's why you're getting a 302 Link to comment https://forums.phpfreaks.com/topic/131309-sql-inject-me/#findComment-682455 Share on other sites More sharing options...
Stooney Posted November 4, 2008 Author Share Posted November 4, 2008 So is that a bad thing? or something to just ignore. Link to comment https://forums.phpfreaks.com/topic/131309-sql-inject-me/#findComment-682493 Share on other sites More sharing options...
waynew Posted November 4, 2008 Share Posted November 4, 2008 Not a bad thing. At least I don't think it is. Would probably have worse implications if it didn't redirect. Link to comment https://forums.phpfreaks.com/topic/131309-sql-inject-me/#findComment-682507 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.