Providing Free and Editor Tested Software Downloads
< HOME | TUTORIALS | GEEK-CADE| WEB TOOLS | YOUTUBE | NEWSLETTER | DEALS! | FORUMS | >

MajorGeeks.com - If you wanna be tweaked you gotta get geeked.

Software Categories

All In One Tweaks
Android
Antivirus & Malware
Appearance
Back Up
Browsers
CD\DVD\Blu-Ray
Covert Ops
Drivers
Drives (SSD, HDD, USB)
Games
Graphics & Photos
Internet Tools
Linux Distros
MajorGeeks Windows Tweaks
Multimedia
Networking
Office & Productivity
System Tools

Other news

· How To and Tutorials
· Life Hacks and Reviews
· Way Off Base
· MajorGeeks Deals
· News
· Off Base
· Reviews




spread the word

· YouTube
· Facebook
· Instagram
· Twitter
· Pintrest
· RSS/XML Feeds
· News Blur
· Yahoo
· Symbaloo

about

· Top Freeware Picks
· Malware Removal
· Geektionary
· Useful Links
· About Us
· Copyright
· Privacy
· Terms of Service
· How to Uninstall

top downloads

1. GS Auto Clicker
2. Smart Defrag
3. Macrium Reflect FREE Edition
4. Sergei Strelec's WinPE
5. MusicBee
6. Visual C++ Redistributable Runtimes AIO Repack
7. ImgBurn
8. K-Lite Mega Codec Pack
9. Unlocker
10. FlyOobe / Flyby11
More >>

top reads

Star 8 Windows Shortcuts That’ll Make You More Productive and Save You Time

Star Windows 10 Not Dead Yet - You Can Still Get Updates For Free

Star What is a '400 Bad Request - Request Header or Cookie Too Large' Error and How to Fix It

Star How to Fix Windows Install Error 0xC1900101

Star How to Force Enable Windows 10 Extended Security Updates If The Option Is Not Showing

Star Windows 11 25H2 is Out: What’s New and How to Get It Now.

Star Star Trek Fleet Command Promo Codes: Redeem Codes for Free Shards, Blueprints And Resources

Star Boost Your PC Speed with ReadyBoost: How a Thumb Drive Can Enhance Your System's Performance

Star 5 Hidden Windows Tools You’ve Had All Along But Never Use

Star Use the Windows 10 Media Creation Tool Before Support Ends For Windows 10 in 2025


MajorGeeks.Com » News » December 2012 » Post from the past: security fix after 8 years

Post from the past: security fix after 8 years


Contributed by: Email on 12/04/2012 04:20 PM [ comments Comments ]


The advisory from January 2005 was just one of hundreds of similar notices around then: a PHP application wasn't validating the parameters of a database query, which could have allowed an attacker with special URLs to inject database commands. The strange thing about this bug report for PHP Gift Registry, however, is that after more than seven years, the program's developer has finally decided to respond.

"All SQL queries have been replaced with parameterized statements in version 2.0.0" is all that is written in a message from Monday, 3 December 2012, that is apparently from the program's developer.

These kinds of SQL injection vulnerabilities are still widespread and are web applications' biggest security issues. Prepared statements are the easiest and most efficient way to protect against them; the developer prepares a database query, declaring which variable should be specified later, like the username:

$stmt = $dbh->prepare("SELECT user FROM users WHERE (user=:user)");
$stmt->bindParam(':user', $user);

When the program is run, the developer only has to specify the username and can then send the prepared database query:

$user = 'ju';
$stmt->execute();

The advantage with this method is that even if, for some strange reason, something like

ju';DROP TABLE users; --

ends up in the $user variable, it will always just be treated like a strange search criterion and will never lead to unwanted database commands like table deletion.






« Tumblr troubled by trojan text - Update · Post from the past: security fix after 8 years · New DVR will use camera and microphone to target advertisements based on recordings of users »




Comments
comments powered by Disqus

MajorGeeks.Com » News » December 2012 » Post from the past: security fix after 8 years

© 2000-2025 MajorGeeks.com
Powered by Contentteller® Business Edition