SQL Injection Attack

Corporal Joined: Apr 17, 2003 Posts: 65

Based on my research here and at ComputerCops, there seems to have been some discussion on this subject, but I have found something strange on my site that requires some explanation.

After running analyze.php, I had a warning regarding the version of PHP on my servers. I have finally received notice from my hosting company that they have upgraded. Now, I am receiving the SQL Injection Attack warning.

However, after reviewing the contents of my php.ini file, I find the following:

Code:

[magic_quotes_gpc] => Array
(
[global_value] => 1
[local_value] => 1
[access] => 6
)

[magic_quotes_runtime] => Array
(
[global_value] => 0
[local_value] => 0
[access] => 7
)

[magic_quotes_sybase] => Array
(
[global_value] => 0
[local_value] => 0
[access] => 7
)

It looks like my setting are fine but I am still receiving the warning ... any clue as to why this is the case?

erbuc

Posted: Sun Aug 10, 2003 1:51 am

Looks okay to me. You might want to check out this thread, if you haven't already:

http://www.computercops.biz/postlite2543-.html

Corporal Joined: Apr 17, 2003 Posts: 65

Hi Vinny,

Yes ... I read all 3 pages of that thread before I even posted here. It seems that those sites did need to make some changes ... and then the continuing debate with the Guest ... but I am not sure that I need to make any changes to my php.ini when it looks like all is fine.

I noticed in that thread that another user posted a possible code fix in the mainfile.php and I noticed no one responded to whether that was a valid fix for the problem. If it is, then the analyze.php file should be fixed to check for that line of code in that file as well before issuing a warning.

I thought this might bring up some new or yet to be resolved issues.

Thanks for the link though.

erbuc

Posted: Sun Aug 10, 2003 2:02 am

You know, I was just looking at my setup and several of the values are empty. Hrm...

Code:

[magic_quotes_gpc] => Array
(
[global_value] => 1
[local_value] => 1
[access] => 6
)

[magic_quotes_runtime] => Array
(
[global_value] =>
[local_value] =>
[access] => 7
)

[magic_quotes_sybase] => Array
(
[global_value] =>
[local_value] =>
[access] => 7
)

I don't know if that would make a difference or not. I assume '' is the same as '0', but I'm not a magic_quotes expert Cool

Corporal Joined: Apr 17, 2003 Posts: 65

I noticed in that thread you provided the link for, that Paul mentioned in his research that when the values were left unassigned, the defaulted to "on".

I hope so ... what does your analyze.php script say?

erbuc
===============
I spent most of my money on booze and women ...
... the rest I just wasted.