Null bytes related issues
<?php
$getal1 = 5.5;
$getal2 = 2.0;
function printDeling() {
$resultaat = global $getal1 / global $getal2;
return $resultaat;
}
function printVermenigvuldiging() {
$resultaat = global $getal1 * global $getal2;
return $resultaat;
}
function printSom() {
$resultaat = global $getal1 + global $getal2;
return $resultaat;
}
function printAftrekking() {
$resultaat = global $getal1 - global $getal2;
return $resultaat;
}
(printDeling()>=7) ? print "<font color=\"green\"> printDeling()</font>" : print "<font color=\"red\"> printDeling()</font>" ;
?>
Database Security
Table of Contents
Nowadays, databases are cardinal components of any web based application by enabling websites to provide varying dynamic content. Since very sensitive or secret information can be stored in a database, you should strongly consider protecting your databases.
To retrieve or to store any information you need to connect to the database, send a legitimate query, fetch the result, and close the connection. Nowadays, the commonly used query language in this interaction is the Structured Query Language (SQL). See how an attacker can tamper with an SQL query.
As you can surmise, PHP cannot protect your database by itself. The following sections aim to be an introduction into the very basics of how to access and manipulate databases within PHP scripts.
Keep in mind this simple rule: defense in depth. The more places you take action to increase the protection of your database, the less probability of an attacker succeeding in exposing or abusing any stored information. Good design of the database schema and the application deals with your greatest fears.
add a note
User Contributed NotesDatabase Security
me at meme dot com
28-Jun-2007 09:23
28-Jun-2007 09:23
somebody at whocares dot com
10-May-2006 06:03
10-May-2006 06:03
Encrypting user input doesn't do much to guard against SQL injection attacks. Naturally, you want to encrypt sensitive information across the wire, but if a user puts in malicious data into an input field, any encryption scheme will just dutifully unpack it at the other and and still run the SQL injection hack if you haven't guarded against it.
Encryption is not magic pixie dust to sprinkle on things to make them more secure.
30-Jun-2005 12:57
you can also chamge CHMOD for some file containing "user names" or "passwords"
webmaster at rackhouse dot net
12-Mar-2005 11:08
12-Mar-2005 11:08
On a database design point of view, you should make sure that you design databases in a manor that any query run from them need minimal input from the user and if it requires user input, that you encrypt where possible.
jjahn at SPAMSUCKS dot signicast dot com
20-Jun-2003 07:17
20-Jun-2003 07:17
I would say one of the best ways to guard against SQL injection is to use the excellent PEAR DB package. If you prepare() and execute() your queries, PEAR will automagically addslashes and handle the query depending on your RDBMS. And of course, for repeatable queries prepare and execute will give you a bit of a readability and speed increase.