pea Posted October 28, 2006 Share Posted October 28, 2006 Hello, I made a blogging script and last night someone pointed out the security holes..I'm fairly new to php so some of it's confusing me a bit and i need some help. Here's what they said, i can do point one so i'll forget about that,[quote]2 - You can erase (even with mq=on) all file that are stored on the server:[...]$t = stripslashes($t);[...]$fc = fopen ("blog_comments/$t.txt", "w");fwrite ($fc, "");[...]3-Using point No 1 you can do some XSS couse there isn't any anti-Xss code for admins4-If mq=on than you can deface the site (but no injecting PHP cause < and > are properly parsed)[/quote]Firstly, what's mq (message queue?)? How can you deface the site. What's wrong with $t = stripslashes($t); ?I need some guidance..Thanks. Pete Quote Link to comment Share on other sites More sharing options...
Daniel0 Posted October 28, 2006 Share Posted October 28, 2006 We would need the source in order to tell you how to make it safe. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.