• Peter Schaefer (unregistered) in reply to Volmarias

    The responsible party is called St. Isidore

  • Peter Schaefer (unregistered) in reply to Nobody S. Pecial

    CAPTCHA Test

    This is a temporary hack until I can get the real CAPTCHA validation working. Just type broken in the textbox below.

    <!-- HIP:ImageHipChallenge Run~at="server" Height="50px" Width="250px" id="wtf_HipImage" / --> <!-- p style="margin:3px;">Prove that you're not a robot. In the textbox below, type in the word you see in the above image.</p --> <input name="ctl00$ctl01$bcr$PostForm$_$wtf_HipText" id="ctl00_ctl01_bcr_PostForm___wtf_HipText" type="text">   <!-- HIP:HipValidator ID="wtf_HipValidator" Run~at="server" Text="* That's not it" CssClass="validationWarning" ControlToValidate="wtf_HipText" HipChallenge="wtf_HipImage" ErrorMessage="- CAPTCHA Validation Failed" / -->

    Note that registered users don't have to do this.

  • Jon (unregistered) in reply to HwAoRrDk
    Anonymous:
    Anonymous:
    I haven't had to think about SQL injection in years. query("SELECT * FROM Message WHERE user_from = %s AND priority = %i AND public = 1", $_GET['from'], $_GET['priority']);
    Oh yes? Well, think again... Use of sprintf() alone does not combat SQL injection. Here, I fixed it for you: mysql_query("SELECT * FROM Message WHERE user_from = '%s' AND priority = %d AND public = 1", mysql_real_escape_string($_GET['from']), $_GET['priority']);
    masklinn has already pointed out that I wasn't using sprintf(), but may I ask why you thought I was? If my query function merely called sprintf, the above example would, in the best case, produce syntax errors like 'SELECT ... WHERE user_from = foo bar ...'. You even noticed that I used %i instead of sprintf's %d. And if, as I claimed, my function prevented SQL injection, don't you think that I must have some sort of centralised security mechanism? How could my example have been confused with a call to sprintf?
  • thisforumsucks (unregistered) in reply to Oliver Klozoff
    Oliver Klozoff:
    This reminds me of a guy I once knew on IRC. His nickname was "essex".  He kept getting banned from channels for an "inappropriate nickname" by bots matching on '*sex*'.



    Reminds me of a slashdot post several months ago: "Three English teams always get blocked by these filters: Arsenal, Scunthorpe, and Manchester Fucking United."

  • toxik (unregistered) in reply to TomCo

    That's Perl blended with PHP (there's no "function" keyword in Perl, and there's no sub parameter list in Perl, additionally there's no eq operator in PHP.)

  • the million$ man (unregistered) in reply to Digitalbath

    the point about the $-signs in the code:

    the code was written for some e-banking organisation.

    and IT managers of e-banking organisations prefer their code written in languages that use $ signs...

     

  • pp (unregistered) in reply to the million$ man

    Can you please let us know the name of the company, so that nobody will deal with these kinds of shitty companies in future and be alert...

  • bullestock (unregistered) in reply to Kieren Johnstone
    Anonymous:
    Yes, it does make it legal C.  If it weren't legal C it wouldnt compile.

    What a load of bollocks.

    For instance, Visual C++ 6 allows you to 'scope' an enum defined in class scope:

    class A
    {
    public:
       enum x { FALSE, TRUE, FILENOTFOUND };
    };

    A::x;

    It's still not legal (C++ in this case), and indeed fails to compile with later Visual C++ versions.
  • PK (unregistered) in reply to ax

    I used to work for a SW company specializing in secure web form management software. The software that they had was used by ISPs, insurance companies etc. The funny thing was that my comrade found out that this 'or 1=1-- trick worked quite well against the software.

    We made top management aware of the problem and they were quite scared. They said the problem must be fixed ASAP but would not allocate any resources to fix it. Finally some poor testers were appointed with the responsibility of fixing the problem. The poor bastard could not even write java code. The fault was buried so deep into the workings of the system that it would have required the full re-design of the whole damn system.

    Eventually the bug was not corrected at all. Even nowadays those poor customers use the system unaware of the fact that any dumb student could become uber-admin in their system without any real skill. This all was two years ago. THE SYSTEM IS STILL IN USE!!!

    That's real WTF I say.

  • (cs) in reply to bullestock
    Anonymous:
    For instance, Visual C++ 6 allows you to 'scope' an enum defined in class scope:

    class A
    {
    public:
       enum x { FALSE, TRUE, FILENOTFOUND };
    };

    A::x;


    Not sure if that's what you meant, but in standard C++, an enum's enumerators are in the same scope as the enum itself. That is, in ISO C++, you would have to say "A::FALSE" etc. from outside A's scope.

    VC++6 however allowed the use of "A::x::FALSE", which is not legal ISO C++.

  • Anonymous (unregistered)

    What's up with using SQL in scripts and middleware anyway? That's so 90's.

    Time for Stored Procs.

  • PHP coder (unregistered) in reply to Zic
    Anonymous:
    Say hello to PHP.  IMHO, this problem could have been solved better with Javascript.  It's better to offload some of the validation on the client-side. That leaves the server free to perform other, more critical tasks... such as echoing the contents of the credit card table to my screen.


    No, that is seriously bad! baaaad!
    Using Javascript as a REPLACEMENT for server-side validation is a huge WTF in web-programming. Never do it, unless you want to be hacked.

    Basically, you can't trust the client will run the Javascipts, or that the client is even a broswer!
    Any kid who knows HTML can easily edit the page to remove your JS validation code and send corrupt data to the server. Any professional could construct their own HTTP headers without even using a browser and send corrupt data to the server.

    JS validation is great to COMPLEMENT server-side validation, but it cant be used as a replacement.


    BTW, got any links to web-sites you've developed, heh heh heh....
  • Nick (unregistered) in reply to PHP coder

    Are you sure you read the post to which you're replying?

  • Ronabop (unregistered) in reply to Zic

    "IMHO, this problem could have been solved better with Javascript."

    Uhm.. WTF should not be followed by more WTF. What are you going to do, use javascript on the prior page? So somebody can just make a page on their hard drive, that POST's to the same server, with dangerous data?

    Oh, let me guess, you'd fix that by making sure that the page it was coming from was the expected origin page.

    Too bad that that information is sent by the client, as well, and thus can be spoofed.

  • Anonymous Coward (unregistered) in reply to Ronabop

    PLEASE STOP THIS ALREADY :D You're killing me!

  • matthew muscari (unregistered) in reply to frosty

    is your name "Amanda," "Seth," or "George?" if so, stop trying to hack the forum!

  • Anonymous (unregistered) in reply to Zic

    You-can't-really-be-serious, right?

    Right?
    I mean seriously; your comment must have been meant as the true WTF??

    On the other hand, of course no hacker smart enough to think of injection could possibly circumvent a client-side check...

  • bill (unregistered) in reply to Peter Schaefer
    Anonymous:

    CAPTCHA Test

    This is a temporary hack until I can get the real CAPTCHA validation working. Just type broken in the textbox below.

    <!-- HIP:ImageHipChallenge Run~at="server" Height="50px" Width="250px" id="wtf_HipImage" / --> <!-- p style="margin:3px;">Prove that you're not a robot. In the textbox below, type in the word you see in the above image.</p --> <input id="ctl00_ctl01_bcr_PostForm___wtf_HipText" name="ctl00$ctl01$bcr$PostForm$_$wtf_HipText" type="text" />   <!-- HIP:HipValidator ID="wtf_HipValidator" Run~at="server" Text="* That's not it" CssClass="validationWarning" ControlToValidate="wtf_HipText" HipChallenge="wtf_HipImage" ErrorMessage="- CAPTCHA Validation Failed" / -->

    Note that registered users don't have to do this.

  • barrister bookcase (unregistered)

    [q

    h;lk

  • major9874 (unregistered)

    OMG! a "hack attept!"

  • neminem (unregistered)

    Wow... been reading back articles recently. Not that anyone's ever going to read this comment, but normally I just think "who would ever write that?" This time, for the first time, I was forced instead to think back to a time when I did, in fact, fix exactly this bug. Though at least the person who wrote our implementation had the forethought to only check full words, so George would be fine. If you wanted to get a document named "table 5", though... too bad.

Leave a comment on “Injection Rejection”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article