RE: [PHP] SQL-Injection, XSS and Hijacking
| From: | Zareef Ahmed | Date: | Thu, 04 Nov 2004 01:54:42 +0000 |
| Subject: | RE: [PHP] SQL-Injection, XSS and Hijacking | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-201112@lists.php.net to get a copy of this message | ||
Hi,
look for escapeshellcmd().
It is another good function to minimize the security risks.
http://in2.php.net/escapeshellcmd
Zaeeef ahmed
>-----Original Message-----
>From: Mark-Walter@t-online.de [mailto:Mark-Walter@t-online.de]
>Sent: Thursday, November 04, 2004 3:55 AM
>To: php-general@lists.php.net
>Subject: [PHP] SQL-Injection, XSS and Hijacking
>Hi,
>I read now quite a lot of articles about SQL-Injection,
>XSS and session hijacking in a hopefully appropriate way.
>As I understand the function addslashes(),quote_meta()
>and mysql_real_escape_string() are to avoid SQL Injection
>e.g. in order to use page_sliding with entered POST data
>over forms with $_REQUEST parameters, while strip_tags(),
>htmlentities() and utf8_decode() is useful to have a
>clean output within the browser by not having arbitrary
>code within.
>For a session authentication PEAR::Auth is used.
>I just wanted to ask if there's more to take care of.
>--
>Best Regards,
>Mark
------------------------------------------------------------------------
--
Zareef Ahmed :: A PHP develoepr in Delhi ( India )
Homepage :: http://www.zasaifi.com