RE: [PHP] Security of PHP code

mh i know it was the wrong decision. didn't think about it. already said that. feeling guilty now *argh* Tim Taubert --------------------------------------------------------------------- Tim Taubert | timtaubert@web.de | http://www.shogunat.com/rg/ --------------------------------------------------------------------- .o] -----Original Message----- .o] From: PHPBeginner.com [mailto:php-general@phpbeginner.com] .o] Sent: Wednesday, July 04, 2001 5:17 PM .o] To: timtaubert@web.de; PHP Mailingliste .o] Subject: RE: [PHP] Security of PHP code .o] .o] .o] Just for the respect of the community, Tim, you shouldn't have posted that. .o] Poor them, they are under the risks, of course the things will be probably .o] fixed, but if someone cares he might be already in the machine just for the .o] sake of it. .o] .o] -maxim maletsky .o] .o] .o] -----Original Message----- .o] From: Tim Taubert [mailto:timtaubert@web.de] .o] Sent: Thursday, July 05, 2001 12:09 AM .o] To: PHP Mailingliste .o] Subject: RE: [PHP] Security of PHP code .o] .o] .o] oh thanks for the disclaimer ;) forgot it.. .o] .o] richard: didn't think about it.. but should have done it.. first and last .o] time i did it *promised* .o] :) .o] .o] Tim Taubert .o] .o] --------------------------------------------------------------------- .o] Tim Taubert | timtaubert@web.de | http://www.shogunat.com/rg/ .o] --------------------------------------------------------------------- .o] .o] .o] -----Original Message----- .o] .o] From: PHPBeginner.com [mailto:php-general@phpbeginner.com] .o] .o] Sent: Wednesday, July 04, 2001 5:09 PM .o] .o] To: timtaubert@web.de; PHP Mailingliste .o] .o] Subject: RE: [PHP] Security of PHP code .o] .o] .o] .o] .o] .o] Yup, I believe you - that's not your site. .o] .o] .o] .o] That is what I meant: It is no PHP, it is how you use PHP. .o] .o] .o] .o] DISCLAIMER: .o] .o] No one's fault (except the programmer) that there was THAT BIG security .o] hole .o] .o] on the site. .o] .o] .o] .o] -maxim maletsky .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] -----Original Message----- .o] .o] From: Tim Taubert [mailto:timtaubert@web.de] .o] .o] Sent: Wednesday, July 04, 2001 11:58 PM .o] .o] To: PHP Mailingliste .o] .o] Subject: RE: [PHP] Security of PHP code .o] .o] .o] .o] .o] .o] you're totally right.. look at this .o] .o] .o] .o] .o] http://www.ssw.uni-linz.ac.at/Teaching/Lectures/Sem/2000/Alexander/source.ph .o] .o] p3?url=/etc/passwd .o] .o] .o] .o] *no comment* and not my site... .o] .o] .o] .o] Tim Taubert .o] .o] .o] .o] --------------------------------------------------------------------- .o] .o] Tim Taubert | timtaubert@web.de | http://www.shogunat.com/rg/ .o] .o] --------------------------------------------------------------------- .o] .o] .o] .o] .o] -----Original Message----- .o] .o] .o] From: PHPBeginner.com [mailto:php-general@phpbeginner.com] .o] .o] .o] Sent: Wednesday, July 04, 2001 4:09 PM .o] .o] .o] To: daviddickson@lycos.com; php-general .o] .o] .o] Subject: RE: [PHP] Security of PHP code .o] .o] .o] .o] .o] .o] .o] .o] .o] SECURE, SECURE. .o] .o] .o] .o] .o] .o] It is not how secure PHP is, it is how well YOU protect it. .o] .o] .o] For example = make this line show_source($file); then go to .o] .o] .o] your page like .o] .o] .o] file.php?file=/etc/passwd and you're freaked! .o] .o] .o] .o] .o] .o] There is a whole bunch of way to hack your pages if not protected .o] well .o] .o] .o] enough, but PHP itself has no vital security problems. .o] .o] .o] .o] .o] .o] Try to search the archives for this topic and see what people .o] .o] .o] think/suggest. .o] .o] .o] You will find there thousands of tips on what to do to have a .o] .o] .o] bullet-proof .o] .o] .o] website. (always of the server is yours). .o] .o] .o] .o] .o] .o] .o] .o] .o] Sincerely, .o] .o] .o] .o] .o] .o] Maxim Maletsky .o] .o] .o] Founder, Chief Developer .o] .o] .o] .o] .o] .o] PHPBeginner.com (Where PHP Begins) .o] .o] .o] maxim@phpbeginner.com .o] .o] .o] www.phpbeginner.com .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] -----Original Message----- .o] .o] .o] From: David A Dickson [mailto:daviddickson@lycos.com] .o] .o] .o] Sent: Wednesday, July 04, 2001 10:43 PM .o] .o] .o] To: php-general .o] .o] .o] Subject: [PHP] Security of PHP code .o] .o] .o] .o] .o] .o] .o] .o] .o] Is it possible for others to view the php code for pages I have .o] .o] .o] written? I .o] .o] .o] thought I heard someone say before that they could write a .o] .o] .o] simple script to .o] .o] .o] accomplish this. If anyone knows of any tacticts people might .o] .o] .o] use to attack .o] .o] .o] my code please post them hee. .o] .o] .o] .o] .o] .o] : David A. Dickson .o] .o] .o] : daviddickson@lycos.com .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] Get 250 color business cards for FREE! .o] .o] .o] http://businesscards.lycos.com/vp/fastpath/ .o] .o] .o] .o] .o] .o] -- .o] .o] .o] PHP General Mailing List (http://www.php.net/) .o] .o] .o] To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net .o] .o] .o] For additional commands, e-mail: php-general-help@lists.php.net .o] .o] .o] To contact the list administrators, e-mail: .o] php-list-admin@lists.php.net .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] .o] -- .o] .o] .o] PHP General Mailing List (http://www.php.net/) .o] .o] .o] To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net .o] .o] .o] For additional commands, e-mail: php-general-help@lists.php.net .o] .o] .o] To contact the list administrators, e-mail: .o] php-list-admin@lists.php.net .o] .o] .o] .o] .o] .o] .o] .o] .o] -- .o] .o] PHP General Mailing List (http://www.php.net/) .o] .o] To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net .o] .o] For additional commands, e-mail: php-general-help@lists.php.net .o] .o] To contact the list administrators, e-mail: php-list-admin@lists.php.net .o] .o] .o] .o] .o] .o] .o] -- .o] PHP General Mailing List (http://www.php.net/) .o] To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net .o] For additional commands, e-mail: php-general-help@lists.php.net .o] To contact the list administrators, e-mail: php-list-admin@lists.php.net .o] .o]