Re: Resolution for ver_export()/addslashes() encoding based script execution attack?

Hi Padraic, On Fri, Feb 28, 2014 at 7:22 AM, Pádraic Brady <padraic.brady@gmail.com>wrote: > On 26 February 2014 22:28, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > >> I don't see how the RFC addressed the problem anyway. > > > > Please research how databases were fixed this issue many years ago. I > don't > > remember well, but I guess it was around 2005. > > I have a vague recollection of issues, but since there's little > specific detail on this (as it pertains to PHP) publicly it's > impossible for most of us to assess what the problem may be. It's even > stranger to see a secret security report being RFC'd publicly, with > Right. This kind of discussion should be done in closed list. > the attendant discussions on list, which appears to go against > responsible disclosure if one can put two and two together in a Eureka > moment. It just spreads a lot of doubt and confusion to no end. For the time being, I suggest look for the details of char encoding based SQL/JavaScript injections. The basic is the same. Regards, P.S. Are we really going to discuss this kind of discussion in public? Can't we just discuss implementation? -- Yasuo Ohgaki yohgaki@ohgaki.net