We hope you enjoy your visit.

You're currently viewing our forum as a guest. This means you are limited to certain areas of the board and there are some features you can't use. If you join our community, you'll be able to access member-only sections, and use many member-only features such as customizing your profile, sending personal messages, and voting in polls. Registration is simple, fast, and completely free.


Join our community!


If you're already a member please log in to your account to access all of our features:

Username:   Password:
Add Reply
  • Pages:
  • 1
  • 3
Php site.com?site
Topic Started: May 5 2005, 10:24 PM (1,083 Views)
Rory May 6 2005, 06:15 PM Post #31
i;m a mess
[ * * * * * * * ]
 I edited all the little problems out of my code just now... but i don't quite get what you mean.

I didn't include the <?php and ?> tags...
Offline Profile Quote Post Goto Top
 
Das May 6 2005, 06:37 PM Post #32
Member Avatar
Smells of rich mahogany
[ * * * * * * * ]
 I know, I think one of the IF tags didn't get closed. Now I get

"Parse error: parse error in /home/www/dastest.madpage.com/test121.php on line 6"

Can you do another once over? Can you pretend I cant mod it, and make it toatlly operational, tags and all.
Offline Profile Quote Post Goto Top
 
Rory May 6 2005, 08:48 PM Post #33
i;m a mess
[ * * * * * * * ]
 bah, i missed the $password = Bob bit

It should have been $password = "Bob";

as should have the one before it... that should be it :)
Offline Profile Quote Post Goto Top
 
Das May 6 2005, 08:56 PM Post #34
Member Avatar
Smells of rich mahogany
[ * * * * * * * ]
 Rory you get thirteen cookies. *Das[/color] gives Rory 13 cookies.
Offline Profile Quote Post Goto Top
 
shockwave- May 8 2005, 08:13 PM Post #35
My other title is a Ferrari
[ * * ]
Joezif
May 6, 2005 04:56 PM
Would that not break / let them in if you entered:

Code:
 
' or 1 == 1 '


in the password box? Just a little injection.

That's called and SQL injection. Some scripts are vulnerable to it. It tricks the script into retriving the first password and username on the table, which is, most often the admin.

Other SQL Injections:

' or 1=1--
" or 1=1--
or 1=1--
' or 'a'='a
" or "a"="a
') or ('a'='a

More info at:
http://www.securiteam.com/securityreviews/5DP0N1P76E.html

Advanced Guestbook 2.2 (unpatched) are vulnerable. If you come accross a site with an AG 2.2, you place no username and as the password, you use one of the injections above (some may be patched).You can deface the main page of the entire site by using a PHP injection on the variable

tlp_name=

just jump down a couple direcotries

tlp_name=../../index.html

Wow, that was offtopic, but I thought I should let some people know.
Offline Profile Quote Post Goto Top
 
Seth May 8 2005, 09:05 PM Post #36
Member Avatar
I has a pony
[ * * * * * * * * * ]
 That's why is_numeric is your pal.
Offline Profile Quote Post Goto Top
 
JoeC May 8 2005, 10:06 PM Post #37
Euch! IE tastes horrible!
[ * * * * * ]
shockwave-
May 9, 2005 01:13 AM
Joezif
May 6, 2005 04:56 PM
Would that not break / let them in if you entered:

Code:
 
' or 1 == 1 '


in the password box? Just a little injection.

That's called and SQL injection.

Is it really?

You don't need to tell me about it :P
Offline Profile Quote Post Goto Top
 
1 user reading this topic (1 Guest and 0 Anonymous)
« Previous Topic · Technology Chat · Next Topic »
Add Reply
  • Pages:
  • 1
  • 3