by BruThoL » Sun Dec 04, 2011 9:31 pm ArvinJA wrote:He's at least using mysql_real_escape_string() to sanitize his input as we can learn from this: http://silmaril.biz/checker.php?a[]=azd&p=azd
However, I don't think he separates user input and SQL (by using prepared statements), so there's probably ways for people to SELECT his entire table and perhaps do something with it, maybe output it in an error, I don't usually do these things though.
"http://silmaril.biz/checker.php?a[]=azd&p=azd"
Right, that's the adress i wrote in irc for loftar
But well, since he's probably doing : "insert into accounts (login, pass) values (mysql_real_escape_string($_GET['a']), mysql_real_escape_string($_GET['p']))"
I don't see much what we can do.
It seems pretty well protected against injection.
But we can still insert thousands of rows (I did 25k already) and let them have fun with this.
Btw, since they are entering credentials in a db, it probably means too that there is a web page where you can access all this information.
.)
