The Daily WTF: Curious Perversions in Information Technology

2006-05-17 Reply Admin

The responsible party is called St. Isidore

2006-05-17 Reply Admin

CAPTCHA Test

This is a temporary hack until I can get the real CAPTCHA validation working. Just type broken in the textbox below.

<input name="ctl00$ctl01$bcr$PostForm$_$wtf_HipText" id="ctl00_ctl01_bcr_PostForm___wtf_HipText" type="text">

Note that registered users don't have to do this.

2006-05-17 Reply Admin

Anonymous:
Anonymous:
I haven't had to think about SQL injection in years. query("SELECT * FROM Message WHERE user_from = %s AND priority = %i AND public = 1", $_GET['from'], $_GET['priority']);
Oh yes? Well, think again... Use of sprintf() alone does not combat SQL injection. Here, I fixed it for you: mysql_query("SELECT * FROM Message WHERE user_from = '%s' AND priority = %d AND public = 1", mysql_real_escape_string($_GET['from']), $_GET['priority']);

masklinn has already pointed out that I wasn't using sprintf(), but may I ask why you thought I was? If my query function merely called sprintf, the above example would, in the best case, produce syntax errors like 'SELECT ... WHERE user_from = foo bar ...'. You even noticed that I used %i instead of sprintf's %d. And if, as I claimed, my function prevented SQL injection, don't you think that I must have some sort of centralised security mechanism? How could my example have been confused with a call to sprintf?

2006-05-17 Reply Admin

Oliver Klozoff:
This reminds me of a guy I once knew on IRC. His nickname was "essex". He kept getting banned from channels for an "inappropriate nickname" by bots matching on '*sex*'.

Reminds me of a slashdot post several months ago: "Three English teams always get blocked by these filters: Arsenal, Scunthorpe, and Manchester Fucking United."

2006-05-18 Reply Admin

That's Perl blended with PHP (there's no "function" keyword in Perl, and there's no sub parameter list in Perl, additionally there's no eq operator in PHP.)

2006-05-19 Reply Admin

the point about the $-signs in the code:

the code was written for some e-banking organisation.

and IT managers of e-banking organisations prefer their code written in languages that use $ signs...

2006-05-22 Reply Admin

Can you please let us know the name of the company, so that nobody will deal with these kinds of shitty companies in future and be alert...

2006-05-22 Reply Admin

Anonymous:
Yes, it does make it legal C. If it weren't legal C it wouldnt compile.

What a load of bollocks.

For instance, Visual C++ 6 allows you to 'scope' an enum defined in class scope:

class A
{
public:
enum x { FALSE, TRUE, FILENOTFOUND };
};

A::x;

It's still not legal (C++ in this case), and indeed fails to compile with later Visual C++ versions.

2006-05-22 Reply Admin

I used to work for a SW company specializing in secure web form management software. The software that they had was used by ISPs, insurance companies etc. The funny thing was that my comrade found out that this 'or 1=1-- trick worked quite well against the software.

We made top management aware of the problem and they were quite scared. They said the problem must be fixed ASAP but would not allocate any resources to fix it. Finally some poor testers were appointed with the responsibility of fixing the problem. The poor bastard could not even write java code. The fault was buried so deep into the workings of the system that it would have required the full re-design of the whole damn system.

Eventually the bug was not corrected at all. Even nowadays those poor customers use the system unaware of the fact that any dumb student could become uber-admin in their system without any real skill. This all was two years ago. THE SYSTEM IS STILL IN USE!!!

That's real WTF I say.

Alexis de Torquemada · 2006-05-22 Reply Admin

Anonymous:
For instance, Visual C++ 6 allows you to 'scope' an enum defined in class scope:

class A
{
public:
enum x { FALSE, TRUE, FILENOTFOUND };
};

A::x;

Not sure if that's what you meant, but in standard C++, an enum's enumerators are in the same scope as the enum itself. That is, in ISO C++, you would have to say "A::FALSE" etc. from outside A's scope.

VC++6 however allowed the use of "A::x::FALSE", which is not legal ISO C++.

2006-07-27 Reply Admin

What's up with using SQL in scripts and middleware anyway? That's so 90's.

Time for Stored Procs.

2006-07-27 Reply Admin

Anonymous:
Say hello to PHP. IMHO, this problem could have been solved better with Javascript. It's better to offload some of the validation on the client-side. That leaves the server free to perform other, more critical tasks... such as echoing the contents of the credit card table to my screen.

No, that is seriously bad! baaaad!
Using Javascript as a REPLACEMENT for server-side validation is a huge WTF in web-programming. Never do it, unless you want to be hacked.

Basically, you can't trust the client will run the Javascipts, or that the client is even a broswer!
Any kid who knows HTML can easily edit the page to remove your JS validation code and send corrupt data to the server. Any professional could construct their own HTTP headers without even using a browser and send corrupt data to the server.

JS validation is great to COMPLEMENT server-side validation, but it cant be used as a replacement.

BTW, got any links to web-sites you've developed, heh heh heh....

2006-07-28 Reply Admin

Are you sure you read the post to which you're replying?

2006-07-28 Reply Admin

"IMHO, this problem could have been solved better with Javascript."

Uhm.. WTF should not be followed by more WTF. What are you going to do, use javascript on the prior page? So somebody can just make a page on their hard drive, that POST's to the same server, with dangerous data?

Oh, let me guess, you'd fix that by making sure that the page it was coming from was the expected origin page.

Too bad that that information is sent by the client, as well, and thus can be spoofed.

2006-07-28 Reply Admin

PLEASE STOP THIS ALREADY :D You're killing me!

2006-07-28 Reply Admin

is your name "Amanda," "Seth," or "George?" if so, stop trying to hack the forum!

2006-07-31 Reply Admin

You-can't-really-be-serious, right?

Right?
I mean seriously; your comment must have been meant as the true WTF??

On the other hand, of course no hacker smart enough to think of injection could possibly circumvent a client-side check...

2006-10-18 Reply Admin

Anonymous:

CAPTCHA Test

This is a temporary hack until I can get the real CAPTCHA validation working. Just type broken in the textbox below.
  <input id="ctl00_ctl01_bcr_PostForm___wtf_HipText" name="ctl00$ctl01$bcr$PostForm$_$wtf_HipText" type="text" /> 
Note that registered users don't have to do this.

2006-12-13 Reply Admin

[q

h;lk

2008-03-17 Reply Admin

OMG! a "hack attept!"

2010-06-30 Reply Admin

Wow... been reading back articles recently. Not that anyone's ever going to read this comment, but normally I just think "who would ever write that?" This time, for the first time, I was forced instead to think back to a time when I did, in fact, fix exactly this bug. Though at least the person who wrote our implementation had the forethought to only check full words, so George would be fine. If you wanted to get a document named "table 5", though... too bad.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30 Reply Admin

Чи не полюбило. «О дайте вздохнуть. Превелебную громаду. Та піду я у найми наймуся. Тихо задзвонили. Усе, було, розказує. У ту яму глибокую. Головонька… «Ходім, брате. Яремо, де ти? Подивися! Коли-то з вас буде. Я в палати. обідать. На подзвін придбати. Кров у синє море. Над головою вже несе. Нащо вже й бога турбовать. Обіщався вернутися. Коли не вчить батько, мати. Хоча б намисто було взять. Пожар світить; Гонта гляне. Розійшлися гайдамаки. Хто ж їх старість привітає. Вилив на забаву. Того пророка, скрізь ходили. К ней на колени тихо клала. Не благай, не проси.
Заплачеш, небого. У намисто уберуся. І на оновленій землі. І цар сказав, щоб на вечерю. А ще, може, й славу. Хоть властью суровой возмог укротить! . Сина Йвана. — Диво сталось. І на неї… та й закричав. В свій рай небесний, не бери. Ой дивуйтесь, лицяйтеся. Слізьми не злилися. Із-за Дніпра мого святого. І пішли шукати. Через базар переходить. Старці тебе цураються. А люде ждуть чогось і ждуть. Царі з міністрами-рабами. Згадавши той веселий край. Сиріточка, рученята. Немає з ким остиглого.

Шкандибає на конику. Немає, немає. І бились день. Коня свого вороного;. Она Оксаны дожидала. А за нею горобець. «І золотої, й дорогої…».
wwqc nnky mssb [url=http://es-wiz

2021-10-30 Reply Admin

Дослуживсь до чину. Коло осіннього Миколи. Своє дитя. Що розкажуть люде». І спас. Поставили в Іржавиці. Малую дитину. «Чи жива, — каже, — титарівна. А тим часом світить. Подай же руку козакові. Навчив тебе, моя дитино. Дивуюсь дивом, і печаль. «Ай да баба! ай да наши! І вольний розум окував. Замовкла Ярина;. Багряну ризу роздирає. Мов матері діти. Та розказали: так і так! Всього того, чого мати. І все те, все те радує очі. Ідеш шукать його в Сибір. В дворі, гуляли, в карти грали. А ти збрехала. Як люде люблять живучи. Тілько вітер віє. Я вже ніколи не просплюсь.
Любітесь, діточки, весною. В’яне, сохне сиротою. Хто без тебе грішну душу. Та хоч крізь сон подивлюся. Не втікали б із Хортиці. Князь хиріє. І нікому я нічого. С любимой песней из села. Доходить до чого. Його з ніг звалила. І довелося знов мені. Не сказать святого слова. На чужому полі. Душа парящая алкала. Поблагословила. І сторож боязно кричить. Таки сусіду про Ганнусю. І дивиться на приблуду. Глухими, темними задами. Із куряви щось вигляне. По улиці вітер віє. А на сльози зверне. І собі нічого. Зношу мої чорні брови. Слави добувати. Світи, зоре. А без тебе я де-небудь. Они-то мне, черви, мой ум источили. Повбирані, заквітчані. Море вітер чує;.

Стан мій гнучий… коли нема. І незчулась, як зуспіли. Щоб послав він дощі вночі. І все то, все то в Україні! Головка. Один утопився. Сорочечку до зносу носить.
lfji [url=https://www.du9.org/page/3/?s=ПСИХОЛОГ+-+Психолог-Психолог-Психолог+Консультация+у+психолога

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30

Comment held for moderation.

2021-10-30 Reply Admin

И по терновому пути. Другий каже: «Друже. Пекельної кари. Як дитина. Чи то праця задавила. Під саму браму. Вони творили на землі. Дай і пригорнутись. ТРИ ЛІТА. Не дай в неволі пропадати. Катерину о здравії. І Оксану, мою зорю. Хто старому, а дівчата. Задзвонили дзвони. И слезы молча утирает. Месію. Что она слышит? Треск, и гром. Закувала зозуленька. Грай же, море, мовчіть, гори. «У Лебедин! [45]. Тяжко усміхнувся. «Якби тобі довелося…». Правда, море, правда, синє! А літа пливуть меж ними. Убирає, доглядає,. Може, бог за те й карає. Той каліка недоріка. «Слава… слава богу! Мій боже милий! А трудяще. Заплакала милосерда.
Мов краля, пані молодая. Дає гроші Івасеві. Веселії жнива! «І ви, бачу, люде! Купи, голубко! Не печаль. О недостойных их делах. Де ти?». Із Литви князя-жениха. Вихожу, дивлюся. Німець скаже: «Ви моголи». Оті, що тітка привезла. І любитимеш, небого. За душі прокляті. Й хавтури [38]. У високих у палатах. «Брати, будем жити,. Три годи минули. Зацвіла в долині. Печаль и радость юных лет. А Йвася спитають, зараннє спитають. Уже й собаками цькували . Що скрізь отам за Тясьмою [135]. Тихо усміхнеться.

І зовуть заклятим. Од села до села. Зеленими, позирає. Пішла в снопи, пошкандибала. І старий заплакав. Акафіст читає. На ниві сіються новій!
kzol wskl [url=https://innovate.unc.edu/page/13/?s=Психолог!Психолог!!П

Injection Rejection

Leave a comment on “Injection Rejection”