Test Please (Hack it, really)

[Lamez]

I am working on a "product catalog", I need to make sure the login gate is secure. I also need to make sure there is no security holes. All I am going to tell you, is there is an admin with the username of james.

 

Link to Test Site: http://www.hssz.net/sz/admin

Product Site      : http://www.hssz.net/sz/

 

Proof of Ownership: http://www.hssz.net/sz/phpfreaks.txt

 

Post any problems! Thanks!

[oni-kun]

Your admin panel is vulnerable to XSS vectors as you don't encode the name when it is incorrect (And placed back into the box), other than that there isn't anything to test, it just seems like an infant script.

[Lamez]

I am not too sure what XSS vectors. I do know what cross-site scripting is though. How would I fix this? Also, did you take a peek at the product site. Is that secure as well? Thanks!

[darkfreaks]

you could start by making sure

 

you have something like

 

 

function clean($str) {
if(!get_magic_quotes_gpc()) {
$str = addslashes($str);
}
$str = strip_tags(htmlspecialchars($str));
return $str;
}

 

and call it like this

clean($variable);

[trq]

you could start by making sure

 

you have something like

 

 

function clean($str) {
if(!get_magic_quotes_gpc()) {
$str = addslashes($str);
}
$str = strip_tags(htmlspecialchars($str));
return $str;
}

 

and call it like this

clean($variable);

 

That function is floored. You only need to escape special characters (addslashes or preferably mysql_real_escape_string) on the way into a database. htmlspecialchars should be used when using data for display, and strip_tags would only be used dependent on the situation and the data involved.