PseudoMega wrote:
I learned a lot by playing with this one:
http://www.phpfreaks.com/tutorials/65/0.php
....
$username = $_POST['username'];
....
$username = stripslashes($u sername);
....
$sql_username_c heck = mysql_query("SE LECT username FROM users WHERE
username='$user name'");
....
$username_check = mysql_num_rows( $sql_username_c heck);
(pffff, ok, I know what to put there.... something along the lines or
$username="a' OR 1 = 1 LIMIT 1")
....
$username_check = mysql_num_rows( $sql_username_c heck);
....
if(($email_chec k 0) || ($username_chec k 0)){...}
(shouldn't that be a == 1?)
....
$sql = mysql_query("IN SERT INTO users (first_name, last_name,
email_address, username, password, info, signup_date, decrypted_passw ord)
VALUES('$first_ name', '$last_name', '$email_address ', '$username',
'$db_password', '$info2', now(), '$random_passwo rd')") or die
(mysql_error()) ;
Uhoh, there goes the database.... I can update another username with my own
custom password without trouble....
The whole tutorial is filled with it. I hope he sais something in the end
about escaping (not stripslashes... .), or this is a highly unsecure login
indeed. I'm not going to read it all though. At least jpmaster was using
addslashes... A nice, yet cumbersome illustration how one can use
memberareas, which is a nice idea. A terrifying lack of safety though.
--
Rik Wasmus
