Backtip operator
| From: | desa15 at necso dot es | Date: | Tue, 29 Jul 2003 10:17:00 +0000 |
| Subject: | Backtip operator | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-157288@lists.php.net to get a copy of this message | ||
Hi to all, any one can tell me, what is the correct way to write secure
applications in php and how is the best way to remove or prevent the
backtip operator.
I think what my code is very insecure.
What is the correct way to do this ???
$Myusername = isset($HTTP_POST_VARS['username']) ? trim(htmlspecialchars
($HTTP_POST_VARS['username'])) : '';
$Myusername = substr(str_replace("\'", "'", $Myusername), 0, 25);
if ($Myusername ==""){
exit;
}
elseif (eregi(";", $Myusername) ){
echo "Hacking attempt";
exit;
}
elseif (eregi("`", $Myusername) ){
echo "Hacking attempt";
exit;
}
$Myusername= str_replace("\'", "''", $Myusername) ;
$Myusername= str_replace("`", "", $Myusername) ;
Un saludo, Danny