omidbrb Posted July 23, 2009 Share Posted July 23, 2009 Hello Everyone, I'm facing a website which is quite badly written, with register_globals turned on and I don't have the time to go through the code and secure the website. Do you think including the following code (that works) above every page in the website will secure the website from cross-site scripting attacks? It's actually scanning all _GET and _SET variables that PHP has turned into variables: foreach(array_keys($_GET) as $kk) { $$kk = htmlspecialchars($$kk); $$kk = str_replace("shell_exec", "little_bunny", $$kk); $$kk = str_replace("exec", "little_bunny", $$kk); $$kk = str_replace("javascript", "evil_bunny", $$kk); } foreach(array_keys($_POST) as $kk) { $$kk = htmlspecialchars($$kk); $$kk = str_replace("shell_exec", "little_bunny", $$kk); $$kk = str_replace("exec", "little_bunny", $$kk); $$kk = str_replace("javascript", "evil_bunny", $$kk); } Best, Omid Link to comment https://forums.phpfreaks.com/topic/167149-securing-an-old-website-coded-with-register_globals-turned-on/ Share on other sites More sharing options...
conker87 Posted July 23, 2009 Share Posted July 23, 2009 I don't see why not? Link to comment https://forums.phpfreaks.com/topic/167149-securing-an-old-website-coded-with-register_globals-turned-on/#findComment-881361 Share on other sites More sharing options...
omidbrb Posted July 23, 2009 Author Share Posted July 23, 2009 Thanks. Just wanted to make sure I've patched all the doors! Link to comment https://forums.phpfreaks.com/topic/167149-securing-an-old-website-coded-with-register_globals-turned-on/#findComment-881366 Share on other sites More sharing options...
xcoderx Posted July 23, 2009 Share Posted July 23, 2009 Only that bit of code can secure a site? Is that code full? Link to comment https://forums.phpfreaks.com/topic/167149-securing-an-old-website-coded-with-register_globals-turned-on/#findComment-881377 Share on other sites More sharing options...
omidbrb Posted July 23, 2009 Author Share Posted July 23, 2009 That's exactly what I'm asking. I wrote this piece of code from what I learned about XSS attacks. I don't know what I'm missing. Link to comment https://forums.phpfreaks.com/topic/167149-securing-an-old-website-coded-with-register_globals-turned-on/#findComment-881383 Share on other sites More sharing options...
xcoderx Posted July 23, 2009 Share Posted July 23, 2009 Pmpl ok but i doubt that bit of code can stop xss Link to comment https://forums.phpfreaks.com/topic/167149-securing-an-old-website-coded-with-register_globals-turned-on/#findComment-881396 Share on other sites More sharing options...
jazz Posted July 26, 2009 Share Posted July 26, 2009 It is useless. Completely useless. Link to comment https://forums.phpfreaks.com/topic/167149-securing-an-old-website-coded-with-register_globals-turned-on/#findComment-883164 Share on other sites More sharing options...
omidbrb Posted July 26, 2009 Author Share Posted July 26, 2009 Definitely. That's why PHP-IDS exists. Link to comment https://forums.phpfreaks.com/topic/167149-securing-an-old-website-coded-with-register_globals-turned-on/#findComment-883170 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.