I am again at the point where I stopped web site building a year ago. I am just DUMBFOUNDED by this PHP magic_quotes bs. It's bizarre.
1) what is PHP-Nuke's philosophy in mod development? My preliminary resarch thinks it's: a) assume magic_quotes is on, b) and even if magic_quotes ain't on it can't hurt to just stripslashes on all Post/Get user variables anyway, so PHP-Nuke is "portable". (I did not find tests for magic_quotes in my recent search of the nuke code).
2) What is "FixQuotes()"? - 100's of calls in so much of the code.
3) Is phpbb worries about adding slashes to GET/POST/COOKIE data really worth extra programming efforrt if magic_quotes is off? Is "SQL injection that bad?
4) Aside from "adding slashes to thwart SQL injection" what are the other situations where you should add slashes?
Are there resources particular to PHP-Nuke that address my questions? Where can I find them? Is PHP-Nuke adequately prepared for poratbility now and future in regards to magic_quotes?
One thing I agree with is someone said that magic quotes is the most poorly thought out procedure in PHP ever. I can't get started!
I also want to use a lot of user get/post input in my mods. Is there any attempt to list all the minor things with special cgharacters one can run into?
ArtificialIntel
Joined: Jan 31, 2004
Posts: -88
Posted:
Mon May 26, 2003 2:05 pm
generally it's a security setting to have GPC_Magic_quotes turned on.
Yes, SQL injection really is that bad, it can bring down web sites, and can be used to redirect sites to other sites via posts etc. (news articles for example which were fixed in secfixpack3)
AI
Phred Nuke Soldier
Joined: Jan 26, 2003
Posts: 28
Location: USA
Posted:
Mon May 26, 2003 11:30 pm
Let me see if I am beginning to understand ...
Making sure that magic_quotes_gpc is on THWARTS all the SQL injection examples for php seen.
However, a stupid module developer could assume he is safe because magic_quotes is on but he could remove slashes with stripslashes and the SQL injection would work. Thus the only true way to avoid SQL injection is really by input validation, etc. ???
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
