note 86959 modified in security.database.sql-injection by felipe
| From: | felipe@php.net | Date: | Wed, 12 Nov 2008 13:14:22 +0000 |
| Subject: | note 86959 modified in security.database.sql-injection by felipe | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-146423@lists.php.net to get a copy of this message | ||
The best prevention is to deactivate master..xp_cmdshell.
Run in isql the command `sp_configure 'xp_cmdshell''
If the value for "config value" is 1 then make in the isql
`sp_configure 'xp_cmdshell',0'.
If you want see the options from your mssql-Server make
`sp_configure 'show advanced options',1'
and then `sp_configure'
--was--
the best prevention is to deactivate master..xp_cmdshell.
Run in isql the command [I]sp_configure 'xp_cmdshell'[/I]
If the value for "config value" is 1 then make in the isql
[I]sp_configure 'xp_cmdshell',0[/].
If you want see the options from your mssql-Server make
[I]sp_configure 'show advanced options',1[/I]
and then [I]sp_configure[/I]
http://php.net/manual/en/security.database.sql-injection.php