I had a client's site and I was trying to stop MySQL Injection on it. The code is so messed up(wasn't coded by me) that I cant use PDO so I tried mysql_real_escape_string() but it is also not stopping attack as according to my research it only works when MySQL DB structure is in UTF8 so I tried to stop the attack manually so I wrote this code  $input = $_REQUEST; foreach ($input as $key=&gt;$value){     $input[$key] = preg_replace("/[^A-Za-z0-9\. ]/", "", $input[$key]);     if($input[$key] =='')     $input[$key]=1; }   I limited only alphanumeric and few other characters for Chatting purposes but this is also not preventing the attack as I run again vulnerability scanner and it says the GET value was set to 6%c0%00xa7%c0%a2 which prompted SQLi error again. Its a HEX value that was converted to 6xa7. Is there any other best approach to stop this attack?
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
18011
Is there a way to get the raw SQL string executed when calling PDOStatement::execute() on a prepared statement? For debugging purposes this would be extremely useful.
326
I'm setting up a new server and want to support UTF-8 fully in my web application. I have tried this in the past on existing servers and always seem to end up having to fall back to ISO-8859-1.  Where exactly do I need to set the encoding/charsets? I'm aware that I need to configure Apache, MySQL, and PHP to do this — is there some standard checklist I can follow, or perhaps troubleshoot where the mismatches occur?  This is for a new Linux server, running MySQL 5, PHP, 5 and Apache 2.
9793
My web server periodically comes under attack, and I get a bunch of requests that look like  /my.page?union+all+select+0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536--  Are there simple command line tools to decode this?
112694
What mysql functions are there (if any) to trim leading zeros from an alphanumeric text field?    Field with value "00345ABC" would need to return "345ABC".
112966
I want to make sure all of the data in my plugins/themes is handled securely  before entering the database and before being output to the browser. My problem is that there are situations where the API handles the sanitization for you -- like when saving post meta fields -- and others where the plugin/theme author is wholly responsible for doing it -- like when saving custom settings.  For the scope of this question, I'm not concerned about validating data at the domain level -- e.g., checking that an Age field on a form is between 0 and 120, or that an e-mail address is valid. I'm only concerned about security -- e.g., escaping SQL queries to avoid SQL injection when saving to the database, or sanitizing data that's output to HTML templates to avoid XSS.  For output sanitization, I know that you always need to use functions like esc_html() and esc_attr() when echo'ing variables into HTML templates. But, what about when using ? Do they all sanitize the output already? If so, for which context (general HTML, tag attributes, etc)? Some functions have variants for different contexts (like the_title_attribute(), but most don't.  For input sanitization, I know that I need to use $wpdb-&gt;prepare() when making manual queries, but what about when using the Settings API to create a plugin settings page, or saving post meta fields for a custom post type?  Right now I've just been digging through Core and reading tutorials every time I use a function to find out if it sanitizes or not, but that's error-prone and time consuming. I'm hoping to find some kind of comprehensive list of all the possible situations and whether or not the API handles it. e.g.,  API validates/sanitizes   Saving post meta with update_postmeta() Saving user meta with update_user_meta() Outputting a post title - use the contextually appropriate variant of the_title() etc   You have to manually validate/sanitize   Saving plugin options with the Settings API. Pass a callback as the 3rd parameter of register_setting(). Direct database queries: Wrap the query in $wpdb-&gt;prepare(). Outputting variables in HTML. Use esc_attr(), esc_html(), etc etc   I'd also be interested to understand why the API provides it in certain situations, but not others. I'm assuming it has something to do with the unknown nature of the data, but would love to hear a thorough explanation.
35802
When i run the following in my console:  [root@****~]# mysql -u root -p -e 'SELECT VERSION();' Enter password: +-----------+ | VERSION() | +-----------+ | 5.5.39    | +-----------+   Which should be the correct version.  However when i enter my PHPMYADMIN on my server it has the following specs:  Server: Localhost via UNIX socket Program: MySQL Programversion: 5.1.73 - Source distribution   So which version is the correct one and how do i make sure that the database is running on 5.5?  Note  I have already restarted sql several times without any changes
19717
I'm building a webapp that takes latex code from users, which is then compiled serverside. Now latex creates a huge system vulnerability since it is turing complete and you can basically hack the entire system by using commands like \openin, \read, \readline or \write.  I've read the articles tagged with security, but I'm not sure yet what is necessary to make the system entirely safe. E.g. it says change the texmf.cnf file. But then in one of the comments it says:     Be aware that a malicious loop could spike the CPU indefinitely. (Dave Jarvis)   A solution for this is not presented. What can be done about this? But so my concrete question is:  Which measures are necessary to make my web page secure, when compiling user latex?
114879
It was hinted in a  that PHP can not reverse Unicode strings.      As for Unicode, it works in PHP   because most apps process it as   binary. Yes, PHP is 8-bit clean. Try   the equivalent of this in PHP: perl   -Mutf8 -e 'print scalar reverse("ほげほげ")' You will get garbage,   not "げほげほ". – jrockway   And unfortunately it is correct that PHPs unicode support atm is at best "lacking". This will .   PHPs  does provide the basic functionality you need to deal with unicode, but it is inconsistent and does lack a lot of functions. One of these is a function to reverse a string.  I of course wanted to reverse this text for no other reason then to figure out if it was possible. And I made a function to accomplish this enormous complex task of reversing this Unicode text, so you can relax a bit longer until PHP6.  Test code:  $enc = 'UTF-8'; $text = "ほげほげ"; $defaultEnc = mb_internal_encoding();  echo "Showing results with encoding $defaultEnc.\n\n";  $revNormal = strrev($text); $revInt = mb_strrev($text); $revEnc = mb_strrev($text, $enc);  echo "Original text is: $text .\n"; echo "Normal strrev output: " . $revNormal . ".\n"; echo "mb_strrev without encoding output: $revInt.\n"; echo "mb_strrev with encoding $enc output: $revEnc.\n";  if (mb_internal_encoding($enc)) {     echo "\nSetting internal encoding to $enc from $defaultEnc.\n\n";      $revNormal = strrev($text);     $revInt = mb_strrev($text);     $revEnc = mb_strrev($text, $enc);      echo "Original text is: $text .\n";     echo "Normal strrev output: " . $revNormal . ".\n";     echo "mb_strrev without encoding output: $revInt.\n";     echo "mb_strrev with encoding $enc output: $revEnc.\n";  } else {     echo "\nCould not set internal encoding to $enc!\n"; }
22185
I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm starting to worry since they are getting more common (last month I got 2 attacks, and on november 7th there are 3 attempts already (1st, 4th and 6th of nov).  I'm not really concerned about it, since I don't have any database. All the info i have on that server is absolutely public, but I'm worried about that attacking-rate increase.  So I thought I could -temporarily- block the IPs that come from those attackers, or something that could make my server ignore requests that ask for phpMyAdmin, pma, xamp, etc.  Is there something like that? my server is Linux+Apache+Php
99589
I am stuck on the prevent SOQL injection trailhead, where I am looking to determine which portions of the code I would need to invoke escapeSingleQuotes or whitelist to enable. I've made several attempts at investigation to little avail. I have appended my code are there any steps I would need to take. My goal is to assess the code to see how it works and what I would need to do.  public class Prevent_SOQL_Injection_Challenge {  public string textOne {get; set;} public string textTwo {get; set;} public string comparator {get; set;} public string numberOne {get; set;}  public List&lt;Supply__c&gt; whereclause_records {get; set;}   public PageReference stringSearchOne(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(textOne != null &amp;&amp; textOne!=''){             whereClause += 'name like  \'%'+string.escapeSingleQuotes(textOne)+'%\' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+whereClause+' Limit 10');     }      return null; }   public PageReference stringSearchTwo(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(textTwo != null &amp;&amp; textTwo!=''){             whereClause += 'Storage_Location__r.name like  \'%'+string.escapeSingleQuotes(textTwo)+'%\' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+whereClause+' Limit 10');     }      return null; }   public PageReference numberSearchOne(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(numberOne != null &amp;&amp; comparator != null){         whereClause += 'Quantity__c '+comparator+' '+string.ValueOf(numberOne)+' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+string.ValueOf(whereClause)+' Limit 10');     }      return null; } }
94051
I want to do something like this:    create table app_users (     app_user_id smallint(6) not null auto_increment primary key,     api_key     char(36) not null default uuid() );    However this results in a error, is there a way to call a function for a default value in mysql?  thanks.
52772
I know how to map a list to a string:  foostring = ",".join( map(str, list_of_ids) )   And I know that I can use the following to get that string into an IN clause:  cursor.execute("DELETE FROM foo.bar WHERE baz IN ('%s')" % (foostring))   What I need is to accomplish the same thing SAFELY (avoiding SQL injection) using MySQLDB. In the above example because foostring is not passed as an argument to execute, it is vulnerable. I also have to quote and escape outside of the mysql library.   (There is a , but the answers listed there either do not work for MySQLDB or are vulnerable to SQL injection.)
96046
I am having a few issues when people are trying to access a MySQL database and they are trying to update tables with the same information.  I have a webpage written using PHP. In this webpage is a query to check if certain data has been entered into the database. If the data hasn't, then i proceed to insert it. The trouble is that if two people try at the same time, the check might say the data has not been entered yet but when the insert takes place it has been by the other person.  What is the best way to handle this scenario? Can i lock the database to only process my queries first then anothers?
76368
How do you stop race conditions in MySQL? the problem at hand is caused by a simple algorithm:   select a row from table if it doesn't exist, insert it   and then either you get a duplicate row, or if you prevent it via unique/primary keys, an error.  Now normally I'd think transactions help here, but because the row doesn't exist, the transaction don't actually help (or am I missing something?).  LOCK TABLE sounds like an overkill, especially if the table is updated multiple times per second.  The only other solution I can think of is GET_LOCK() for every different id, but isn't there a better way? Are there no scalability issues here as well? And also, doing it for every table sounds a bit unnatural, as it sounds like a very common problem in high-concurrency databases to me.
6749
What are the best workarounds for using a SQL IN clause with instances of java.sql.PreparedStatement, which is not supported for multiple values due to SQL injection attack security issues: One ? placeholder represents one value, rather than a list of values.  Consider the following SQL statement:  SELECT my_column FROM my_table where search_column IN (?)   Using preparedStatement.setString( 1, "'A', 'B', 'C'" ); is essentially a non-working attempt at a workaround of the reasons for using ? in the first place.    What workarounds are available?
1833
Recently I started getting an error every time I try and add a content no matter what type.  This is the error that shows up in the browser:     Additional uncaught exception thrown while handling exception.        Original   PDOException: SQLSTATE[HY000]: General error: 2006 MySQL server has gone away: SELECT COUNT(cid) FROM {comment} WHERE status = :status; Array ( [:status] =&gt; 0 ) in comment_count_unpublished() (line 313 of /Applications/MAMP/htdocs/modules/comment/comment.module).        Additional      PDOException: SQLSTATE[HY000]: General error: 2006 MySQL server has gone away: INSERT INTO {watchdog} (uid, type, message, variables, severity, link, location, referer, hostname, timestamp) VALUES (:db_insert_placeholder_0, :db_insert_placeholder_1, :db_insert_placeholder_2, :db_insert_placeholder_3, :db_insert_placeholder_4, :db_insert_placeholder_5, :db_insert_placeholder_6, :db_insert_placeholder_7, :db_insert_placeholder_8, :db_insert_placeholder_9); Array ( [:db_insert_placeholder_0] =&gt; 1 [:db_insert_placeholder_1] =&gt; php [:db_insert_placeholder_2] =&gt; %type: !message in %function (line %line of %file). [:db_insert_placeholder_3] =&gt; a:6:{s:5:&quot;%type&quot;;s:12:&quot;PDOException&quot;;s:8:&quot;!message&quot;;s:154:&quot;SQLSTATE[HY000]: General error: 2006 MySQL server has gone away: SELECT COUNT(cid) FROM {comment} WHERE status = :status; Array ( [:status] =&amp;gt; 0 ) &quot;;s:9:&quot;%function&quot;;s:27:&quot;comment_count_unpublished()&quot;;s:5:&quot;%file&quot;;s:56:&quot;/Applications/MAMP/htdocs/modules/comment/comment.module&quot;;s:5:&quot;%line&quot;;i:313;s:14:&quot;severity_level&quot;;i:3;} [:db_insert_placeholder_4] =&gt; 3 [:db_insert_placeholder_5] =&gt; [:db_insert_placeholder_6] =&gt; ; [:db_insert_placeholder_7] =&gt;  [:db_insert_placeholder_8] =&gt; 127.0.0.1 [:db_insert_placeholder_9] =&gt; 1338336955 ) in dblog_watchdog() (line 154 of /Applications/MAMP/htdocs/modules/dblog/dblog.module).   I also get the following error in my php error file:     PHP Fatal error:  Uncaught exception 'PDOException' with message 'SQLSTATE[HY000]: General error: 2006 MySQL server has gone away' in /Applications/MAMP/htdocs/includes/database/database.inc:2136        Stack trace:   0 /Applications/MAMP/htdocs/includes/database/database.inc(2136): PDOStatement->execute(Array)   1 /Applications/MAMP/htdocs/includes/database/database.inc(664): DatabaseStatementBase->execute(Array, Array)   2 /Applications/MAMP/htdocs/includes/database/database.inc(2315): DatabaseConnection->query('SELECT expire, ...', Array, Array)   3 /Applications/MAMP/htdocs/includes/lock.inc(167): db_query('SELECT expire, ...', Array)   4 /Applications/MAMP/htdocs/includes/lock.inc(146): lock_may_be_available('theme_registry:...')   5 /Applications/MAMP/htdocs/includes/theme.inc(447): lock_acquire('theme_registry:...')   6 /Applications/MAMP/htdocs/includes/bootstrap.inc(427): ThemeRegistry->set(Array)   7 [internal function]: DrupalCacheArray->__destruct()   8 {main}         thrown in /Applications/MAMP/htdocs/includes/database/database.inc on line 2136   I am having a little trouble deciphering these error messages. Could anyone help me understand what's going on here?