Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Web Application Security
Name:
Email:
*Note: Email address will appear as "user domain ext" to prevent harvesting.
Subject:
Message:
 
RE: Anyone have some basic security tips for PHP-programmers? Nov 20 2003 12:50AM
arek chelmnet pl
> Your first code block:
> 1. Request Variables, containing variables will be evaluated. (e.g.
> $config[mysql_pass]
OK, so we should to escape or drop $,,,[,],etc...
> 2. The keys will not be escaped

> (file.php?a%3D1%3B+print+file_get_contents%28%22%2Fetc%2Fshadow%22
> %29%3B+%2F
> %2F=hacked)
Hm...

[ more ]  




 

Privacy Statement
Copyright 2009, SecurityFocus