ryanfilard Posted May 27, 2011 Share Posted May 27, 2011 I have https:// ryanweekly.com proof of ownership: http://www.ryanweekly.com/phpfreaks.txt Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/ Share on other sites More sharing options...
cssfreakie Posted June 7, 2011 Share Posted June 7, 2011 as far as i can tell, you allow very odd passwords usernames and emailaddresses. Also the script to verify the emailadress is not working correctly since anything is valid. Also i have a strong feeling (which i am happy to email you) that some other form is allowing pretty bad things. Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/#findComment-1226201 Share on other sites More sharing options...
ryanfilard Posted June 7, 2011 Author Share Posted June 7, 2011 My email is ryanweekly@gmail.com what is really bad please email me Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/#findComment-1226209 Share on other sites More sharing options...
pastcow Posted June 7, 2011 Share Posted June 7, 2011 Your website is littered with SQL injection vulnerabilities. Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/#findComment-1226414 Share on other sites More sharing options...
ryanfilard Posted June 8, 2011 Author Share Posted June 8, 2011 as far as i can tell, you allow very odd passwords usernames and emailaddresses. Also the script to verify the emailadress is not working correctly since anything is valid. Also i have a strong feeling (which i am happy to email you) that some other form is allowing pretty bad things. I fixed everything but the Verify Script I don't think there are any more issues beside SQL Injection Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/#findComment-1227221 Share on other sites More sharing options...
cssfreakie Posted June 9, 2011 Share Posted June 9, 2011 well make sure you fixed that sql injection vulnerability, because otherwise someone could walk off with your database. And i assume you don't want to end up (ryan)weekly in the papers like sony does btw are you using: action="<?php echo $_SERVER['PHP_SELF'];?>" in your forms? right now some forms are vulnerable for cross side scripting. Have a read here how to prevent it: http://seancoates.com/blogs/xss-woes Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/#findComment-1227239 Share on other sites More sharing options...
thewooleymammoth Posted June 29, 2011 Share Posted June 29, 2011 using regex on your form input and mysql_real_escape_string() takes out almost all sql injections. Someone has got to be pretty clever to get through that. It also fixes your verification issues. Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/#findComment-1236106 Share on other sites More sharing options...
thewooleymammoth Posted June 29, 2011 Share Posted June 29, 2011 well make sure you fixed that sql injection vulnerability, because otherwise someone could walk off with your database. And i assume you don't want to end up (ryan)weekly in the papers like sony does btw are you using: action="<?php echo $_SERVER['PHP_SELF'];?>" in your forms? right now some forms are vulnerable for cross side scripting. Have a read here how to prevent it: http://seancoates.com/blogs/xss-woes If you want to post to the same page your at, action='' //or action='?this=works&also=' [/code] is all you need. Problem solved. Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/#findComment-1236107 Share on other sites More sharing options...
Coreye Posted July 12, 2011 Share Posted July 12, 2011 SQL Error: If you're not logged in and you try to post on a user profile you get this error: Column 'post' cannot be null. SQL Error: http://www.ryanweekly.com/user/?p=' You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''' ORDER BY id DESC LIMIT 0, 6' at line 1 Link to comment https://forums.phpfreaks.com/topic/237596-is-my-site-secure-for-users-to-register/#findComment-1241679 Share on other sites More sharing options...
Recommended Posts