note 120304 deleted from security.database.sql-injection by cmb
| From: | cmb@php.net | Date: | Fri, 09 Dec 2016 09:48:19 +0000 |
| Subject: | note 120304 deleted from security.database.sql-injection by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-208289@lists.php.net to get a copy of this message | ||
Note Submitter: carl at sagan dot com
----
Nikolay Mihaylov ,
Your security measure is completely vulnerable and it's very poor.
What if your client is doing an EVAL on unfiltered user input, and the attacker injects something
like:
$code = "base" . "64_encode";
$encoded = $code("LOL");
print $encoded;
For those new to PHP reading this, DON'T do what Nikolay Mihaylov suggested, please.