Full Disclosure mailing list archives
Re: SQL Injeciton.
From: Jeremy Bishop <requiem () praetor org>
Date: Fri, 19 Aug 2005 21:30:03 -0700
On Friday 19 August 2005 20:20, Gabbar Sing wrote:
Hi, We have an internal web application written in PHP, in which the developer has got following line.
<snip>
At first sight I though its very much vulnerible to SQL Injection, but I am not just able to demonstrate it. As when i send the character " ' " it just escapes it before sending query to db as " ' " thus failing my injection.
PHP has a feature known as magic quotes that can provide automatic escaping of quotes in user-submitted data. I believe the configuration variables to look at are "magic_quotes_gpc" and "magic_quotes_sybase", or some variation on those; the documentation should be more revealing. The developer may also have manually sanitized the data; I assume you have checked for that already? The ideal means of handling input would be to have the code check whether magic quotes are enabled and to take appropriate action based on the result of that check. -- My group's mission statement - 'You want *what* ? By *WHEN* ?' -- Simon Burr _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- SQL Injeciton. Gabbar Sing (Aug 19)
- Re: SQL Injeciton. Jeremy Bishop (Aug 19)
- <Possible follow-ups>
- Re: SQL Injeciton. Gabbar Sing (Aug 19)