elis Posted January 17, 2007 Share Posted January 17, 2007 I'm not entirely sure how to explain my problem, but I'll try.I have the following code:[code]if(!$tid) accessDenied( );[/code]to prevent mysql attacks via the url: i.e.http://yoursite.net/thispage.php?tid="select * from this_table"and it works except for when the single quotes are usedi.e. http://yoursite.net/thispage.php?tid='select * from this_table'and the databases are being selected and are accessible this waydoes anyone have any coding ideas that could prevent this? Link to comment Share on other sites More sharing options...
Jessica Posted January 17, 2007 Share Posted January 17, 2007 look up mysql_real_escape_string and do some research on SQL injection Link to comment Share on other sites More sharing options...
elis Posted January 17, 2007 Author Share Posted January 17, 2007 Yes, well I've tried that numerous times - it isn't working, hence why I came here. Link to comment Share on other sites More sharing options...
dgiberson Posted January 17, 2007 Share Posted January 17, 2007 Are you using the GET/REQUEST or POST method? Link to comment Share on other sites More sharing options...
Jessica Posted January 17, 2007 Share Posted January 17, 2007 [quote author=elis link=topic=122836.msg507096#msg507096 date=1169059111]Yes, well I've tried that numerous times - it isn't working, hence why I came here. [/quote]Yes, well, that's not in your code. Posting actual code and explaining problems prevents useless answers. The code you HAVE, does NOT prevent against any SQL attacks. Hence, my answer.Plus, it looks like you're using register_globals, a big security no-no. Link to comment Share on other sites More sharing options...
elis Posted January 17, 2007 Author Share Posted January 17, 2007 There's absolutely no need for your childish condescending attitude,in any event I've fixed the problem using a variation of the eregi function. Link to comment Share on other sites More sharing options...
elis Posted January 17, 2007 Author Share Posted January 17, 2007 [quote author=dgiberson link=topic=122836.msg507098#msg507098 date=1169059258]Are you using the GET/REQUEST or POST method? [/quote]You really should be able to edit posts after more than a few seconds o.0Anyway: I was using the _GET function, but after tinkering I figured out my error.Thank you for your help though. Link to comment Share on other sites More sharing options...
dgiberson Posted January 17, 2007 Share Posted January 17, 2007 Just a suggestion, you might want to switch over to POST, although I am not sure at what your goal is for this specific page. Link to comment Share on other sites More sharing options...
Recommended Posts