Please I am pulling my hair trying to find any answers to checking security.
Thanks in advance
To be honest macman, it would make more sense if you posted your code rather than a link to a page. that way, we can see what measures you have taken to secure the page, and suggest possible flaws which need rectifying
function pt_register() { $num_args = func_num_args(); $vars = array();
if ($num_args >= 2) { $method = strtoupper(func_get_arg(0));
if (($method != 'SESSION') && ($method != 'GET') && ($method != 'POST') && ($method != 'SERVER') && ($method != 'COOKIE') && ($method != 'ENV')) { die('The first argument of pt_register must be one of the following: GET, POST, SESSION, SERVER, COOKIE, or ENV'); }
$varname = "HTTP_{$method}_VARS"; global ${$varname};
$sql = 'insert table_name set Field="'.mysql_real_escape_string($value).'"' ;
Notice the long mysql_real_escape_string() command... processes the value to make safe for using in the query. (not sure exactly what it does lol)
I think you can use this for getting the posted info to:
PHP Code:
extract($_POST, EXTR_SKIP) ;
This will convert all the posted field into variables.
The EXTR_SKIP part means: dont replace any existing variables (security issue)
This saves a large amount of typing
What mysql_real_escape_string does is escape certain characters that could either break the query or allow for an injection attack. It's much preferred over addslashes() and stripslashes() which are commonly recommended.
It's generally not recommended to use globals or extract() in this case, but that's a separate topic altogether.
A quick fix for your code would be to do a regex search/replace:
In addition to sanitizing incoming data, this is a handy block of stuff to stick in your .htaccess file:
HTML Code:
########## Begin - Rewrite rules to block out some common exploits
#
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
# Block out any script that includes a <script> tag in URL
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Send all blocked request to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.htm [F,L]
#
########## End - Rewrite rules to block out some common exploits
In addition to sanitizing incoming data, this is a handy block of stuff to stick in your .htaccess file:
HTML Code:
########## Begin - Rewrite rules to block out some common exploits
#
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
# Block out any script that includes a <script> tag in URL
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Send all blocked request to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.htm [F,L]
#
########## End - Rewrite rules to block out some common exploits
Every little bit helps.
Very useful. Thanks End User. Will be using that myself
Linear Mode
