« first day (660 days earlier)      last day (4285 days later) » 

12:00 AM
i aint good at anything, but from the security tutorials i've read, uhmm, simple sanitation of your POST data will do it. perhaps.
 
and update your website from mysql_* to pdo
but for now, disable connection to your database
 
I can't...
my website is a game
players need to register into it in order to play
also, disabling the website has no point...
The fact is that the hacker is a player
I know him...but I have nothing to do...
I believe he is doing injections through "_GET" and "_POST" variables
 
use mysql_real_escape_string on your queries for now, then update your website to PDO
 
for now, what you could do is try to have another copy of your site, and redo your db queries, use pdo man.
 
I have this
 
12:05 AM
yes, nile is right
 
$idog = mysql_real_escape_string($_GET['id']) ? mysql_real_escape_string($_GET['id']) : addslashes($_GET['id']);
Is it unsafe?
I receive an error if I type:

url.com/index.php?id=1' (with that quote ')

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1
 
why dont you just do $idog = @mysql_real_escape_string($_GET['id'])
 
it's fine, but its using GET, so I think he can just use the address bar to replace the values
 
@mysql_... is better?
I can change
 
but im not sure if i am right
 
12:07 AM
no, the @ will just suppress the warning
 
right again
 
Nile, I don't know what to do...I'm not programmer
 
Believe, I'm embarassed as you can' imagine...
 
who made your website for you?
 
12:08 AM
old programmer
 
main him fix it
 
yeah
 
I can't contact him since ~2 years
 
but for now, just do $idog = mysql_real_ecape_string($_GET['id']);
 
12:08 AM
Also I haven't money to pay for fixes...
 
see if you still get the warning
 
in that case, be a programmer, hire a programmer.
or shutdown your site, LOL
 
Nile, with your code the error disappeared, but it stills "hackable", isn't it?
 
shouldn't be
well, it probably is because your old programmer was a very ignorant programmer
but for now, see if the injections still occur
 
I don't know how to inject
 
12:11 AM
nile, hack him, haha
 
The hacker told me he was doing injections and even if I fix injections he would have other ways to hack me
 
fine, send me the website I'll test it
 
can I send private message?
 
you can just send it heree
 
www.darkedengenesis.com
br.darkedengenesis.com
 
12:13 AM
which one
second or first
 
both
br = brazilian language
www = english
I have POST and GET variables on many places of my website
 
where was he doing the injection?
 
I have no idea
That's what I'm trying to discover
 
well give me an idea of where to perform the sql injection
 
oh my....
I have no idea on how it works...
www.darkedengenesis.com/recovery/recoveryen.php
 
12:18 AM
now give me an email that a user is signed up with
 
test@test.com
 
does this email exist in the database?
 
yes
Nile
are you a good programmer?
 
depends
 
deppends on language?
 
12:20 AM
where did you first notice the injection
 
the hacker said about a program named "Havij"
 
?
 
With that program I could hack my DB
 
but DID he?
 
www.darkedengenesis.com/index.php?id=1
DID he what?
the hacker is logging in all players accounts
stealing them...
 
12:22 AM
hmm, wonder whats the encryption of the user's password
 
I'm desperate...I'm sorry for this...I just can't stay calm..
16 bytes encryption
one way encryption...
but since he has the access to my DB, he can change pass to whatever he wants
 
has he proven to you that he has hacked it?
 
are you sure, he is able to hack it?
 
he loggged in my GM account..
 
gm?
 
12:23 AM
game master
 
yes Game Master
Administrator account...
 
are you still able to log in?
 
I have just searched my DB and I have found that 123 accounts have the same password
yes, I'm
that password is the same of the hacker account password
 
in that case, he aint change your password. he just knw the password
 
no, I have access because I changed it back...
 
12:25 AM
i see.
 
He is driving me crazy
If I had money I would find someone to do it for me
 
ask him on what page hes hacking from
 
He is offline right now
Nile, are you good with PHP / MySQL?
 
yes, since he's just tripping on you
 
not that great with mysql
 
12:26 AM
Look at this my family and I, are about to be evikted
The process is almost done
Sometimes I don't know what do...
 
@Darkeden no.
 
lol, when trying to register:
 
hakre, do you know what I must to do?
 
The username 'OR''=' is already in use.
 
$username = strip_tags(trim($_POST['username']));
$name = (!get_magic_quotes_gpc) ? addslashes($_POST['name']) : $_POST['name'];
$email = (!get_magic_quotes_gpc) ? addslashes($_POST['email']) : $_POST['email'];
$password = $_POST['password'];
$confirmpassword = $_POST['confirmpassword'];
$ssn = $_POST['ssn'];
$country = (!get_magic_quotes_gpc) ? addslashes($_POST['country']) : $_POST['country'];
$sex = $_POST['sex'];
$errorstr = "";
$errorstr = checknewid($username,$name,$password,$confirmpassword,$ssn,$country,$sex,$email);
 
12:28 AM
@Darkeden Injection does not mean much but just injection. It's always some kind of injection.
@Darkeden You must do a code-review of your code.
 
Nile, this is variables
 
@hakre, are you saying no to his question about if i was good with php?
 
no Nile...he said "@mysql_real...." isn't better than my other "mysql_real..."
 
@Nile now as he showed an actual code block, I'd say this needs some treatment.
 
is this for the register page?
 
12:30 AM
@Darkeden Actually I wanted to point out to not use the @ operator in that context.
 
hakre, I explained earlier that I'm not programmer...I have to improve my website on my own
 
First line of your code should go:
 
yes, that is new_account.php
 
honestly, I could set my "sex" to "dinosaur" and the form would still work
 
i think yes, this is
 
12:31 AM
@Nile yes, that is new_account.php
 
You should decide if you actually want to operate on add slashes or parametrized queries.
You should use parametrized queries.
 
i will just edit the markup, and some frontend restrictions will be bypassed.. right?
 
Start to use PDO.
 
But first of all it probably is important that you put the code under version control.
 
12:33 AM
What should I choose? parametrized or add slashes?
Also what is version control? like backup?
 
@Darkeden, I cant find where he did the injection, sorry
 
No version control is not backup. Version control is keeping track of changes to the software, cerating a new version with each change.
 
it's like changing yoursite, but not uploading until the other version is done
 
And go with PDO, not add slashes. See Give me parameterized SQL, or give me death - Year 2005
Please, don't use mysql_* functions to write new code. They are no longer maintained and the community has begun deprecation process. See the red box? Instead you should learn about prepared statements and use either PDO or MySQLi. If you can't decide which, this article will help you. If you pick PDO, here is good tutorial.
 
Hakre, I'm not programmer, I'm reading what you send me...but I'm lost
 
12:40 AM
@Darkeden whats the actual url to this page: darkedengenesis.com/notices/106/…
 
index.php?action=show&class=$class&id=$id

class = 0 or 1
0 = updates
1 = notices
 
@Darkeden Okay, you need a programmer that is taking care of your site, one that is firm with security related topics.
 
have you made any changes to index.php since the hack?
 
yes
 
not sure if this is a good idea, but would you mind temporarily undoing those changes so I can check if I'm trying the right stuff
 
12:42 AM
@hakre yes...but I don't have money to pay
these are the changes: <?php

define("URL","http://www.darkedengenesis.com/");

echo URL;
var_dump($_GET['url']);
?>
 
@Darkeden then you should just take your website offline.
 
you didnt implent any real escape changes?
 
@hakre you have nothing to do with my problems, but I have nothing to do...
 
copy and paste all of index.php to a pastebin
 
@Nile wait
 
12:44 AM
@hakre is right. if you cant afford to fix the issue, get rid of the problem.
do it now please
 
do what?
 
upload the contents of index.php to a pastebin or a textfile that i can look at
 
he can do whatever he wants it's his site. anyway I just was giving cheap advice as he wrote he has no money nor developer resources.
 
I'm doing, wait
Don't get me wrong...
I have bad english also I'm very desperate...
 
please do it now...
@Darkeden whistle whistle
 
   include_once("include/config.php");
    include_once("include/paypal_config.php");
    include_once("include/smtp.php");
    include_once("include/function.php");
    require_once("process.php");
    include_once("include/left.php");
    include_once("include/middle.php");
show me those also
 
Nile
I scarry to put this info in the web
 
okay, then I can't help you
 
give me some email, msn, gtalk, facebook where I can send you please
I can give you even team viewer access
 
did you get that?
 
12:55 AM
@Darkeden: Please stop now abusing the chat here to trick others into helping you.
I can understand you are in a situation that is unpleasant to you, but this is not the right forum to get the mess you have into order
 
Hey can someone look at this and tell me what's wrong with it?
 
"Discussion for all things PHP - Don't ask whether someone is here or can help. Just tell us your problem. If anybody can and wants to help, they will"
 
Haha, maybe I should learn to read
 <input type="hidden" name="playerData" id="playerData" value="[{[{"ID":"Network ID","Rank":"Rank","Prestige":"0","Level":"0"},{"ID":"Network ID","Rank":"Rank","Prestige":"0","Level":"0"},{"ID":"Network ID","Rank":"Rank","Prestige":"0","Level":"0"},{"ID":"Network ID","Rank":"Rank","Prestige":"0","Level":"0"}]">
My PHP is this
print_r($_REQUEST);
if(empty($_REQUEST['playerData']))
{
	echo "No playerData found.";
}
else
{
	echo $_REQUEST['playerData'];
}
 
and?
 
My output is
Array ( [full_name] => sfgyd6tsdr7uh6er7h6 [network_id] => tyfrygdtuhf6t [email] => email [clan_name] => yhtxfythryhtr [website] => site[console] => 2 [number] => 2 [file] => L.PTR [comments] => gvcxhg [p_scnt] => Network ID [p_scnt1] => Rank [prestige] => 0 [level] => 0 ) No playerData found.
The playerData field is added dynamically with this
function addPlayerString() { document.getElementById('JSONString').innerHTML += "<input type='hidden' name='playerData' id='playerData' value='" + JSON.stringify(players) +"'>"; }
 
1:01 AM
and what do you not understand?
 
Why isn't the playerData being POSTed?
 
There is nothing to understand..there is an error, so why not help him fix it?
 
It isn't? Your output shows it is posted.
 
Where? It says "No playerData found"?
 
change if(empty($_REQUEST['playerData'])) to if(empty($_REQUEST)) and that message will disappear.
 
1:04 AM
What? That doesn't make sense - I want to check if playerData is set
 
he is wanting to echo the data (playerData)
 
The message might disappear but I'll get an error this time
 
what's with the "three blind mice" routine ?
 
It just looks like that $_REQUEST contained one player details so I assumed this is what you're looking for.
 
why are you even using $_REQUEST ?
 
1:10 AM
@tereško Because I need to accept $_GET and $_POST
 
i think i dont want to know , actually
 
lol
 
@Lusitanian can you look at Kain's Question?
I am trying to figure it out, but can not...
 
link?
 
It's not on SO proper
It's just like..up there ^^
 
1:20 AM
i'm too lazy to scroll ):
 
auto scroll
 
i read it
okay...use live http headers or similar and make sure your data is actually getting POSTed
and then get back to me
also you really shouldn't use $_REQUEST
 
Why?
 
more trouble than it's worth
you should explicitly define where you want your data coming from
 
1:22 AM
What trouble does it cause?
 
Cthulu will be unleased upon your code
 
does it not post and Get?
i thought it did both?
 
It does POST, GET, and COOKIE
 
Hahaha I read that just the other day
 
so basically, if you set a cookie with the same key as your POST request
you'll spend several confused hours trying to figure out why you aren't getting any data
or are getting the wrong data
 
1:25 AM
Is there a Chrome equivalent of Live HTTP Headers?
 
plus there's no reason to accept multiple HTTP verbs for the same form
@KianMayne yes...? the built in dev tools :P
 
Where?
 
i don't recall, haven't used chrome in a couple years...google it, should be under that little wrench menu
 
I know where the Dev tools are
But not http headers
 
should be under the network panel
 
1:27 AM
Found them
 
yeah
 
hi :)
 
someone here use mysql workbench?
 
1:28 AM
It's not being sent
 
how are you guys?
^^
 
@KianMayne so it's a problem with your javascript
go check it again
and/or show it to me
 
The Javascript works
because I can see the hidden element being generated
30 mins ago, by Kian Mayne
 <input type="hidden" name="playerData" id="playerData" value="[{[{"ID":"Network ID","Rank":"Rank","Prestige":"0","Level":"0"},{"ID":"Network ID","Rank":"Rank","Prestige":"0","Level":"0"},{"ID":"Network ID","Rank":"Rank","Prestige":"0","Level":"0"},{"ID":"Network ID","Rank":"Rank","Prestige":"0","Level":"0"}]">
 
i'm trying to make (and understand this)
ALTER TABLE `tbl_issue` ADD CONSTRAINT `FK_issue_project` FOREIGN KEY (`project_id`) REFERENCES `tbl_user` (`id`) ON DELETE CASCADE ON UPDATE RESTRICT;
 
@KianMayne is it before the form submit though? and is it being added to the form that's being submitted?
 
1:31 AM
Yeah it's executed in the onsubmit attribute
 
can i see the actual javascript
 
and when I've tried running it through the JS console and then submitting, I get the same request
31 mins ago, by Kian Mayne
function addPlayerString() { document.getElementById('JSONString').innerHTML += "<input type='hidden' name='playerData' id='playerData' value='" + JSON.stringify(players) +"'>"; }
 
what is JSONString
what element is it
also...
your form element is totally malformed
given that your data contains tons of quotes
that aren't escaped
which would break it easily
replace each " with a \"
therefore:
 
No, you're misreading
 
no, i'm not.
 
1:33 AM
They break it up from the Javascript
 
the + JSON.stringify(players) + is Javascript, not part of the string
 
function addPlayerString() { document.getElementById('JSONString').innerHTML += "<input type='hidden' name='playerData' id='playerData' value='" + JSON.stringify(players).replace('"', '\"') +"'>"; }
that code will work
I know :)
 
Ahh
Also, I found a bigger problem
 
THIS IS PHP CHAT ROOM
4
 
1:35 AM
oh sorry
 
It wildly missed the form tage
 
it should replace each " with an &quot;
@tereško is right...go to the javascript chatroom, you'll get help from someone who isn't an exhausted non-javascript developer (:
 
It's inactive :L
 
then ask on SO
but just change the \" in my revised code to &quot; and it should work anyway
not that i understand why the hell you're dynamically adding an element in perhaps the worst way possible...but if it works for you then it works for you
 
Sometimes I'd be happy if there were on Stackoverflow a possibility to hide some people's questions, like a personal blacklist...
 
1:43 AM
You could always write a userscript to do it
 
@Jocelyn I wish I could hide questions, automatically, from anyone who has an IQ of less than 20 or hasn't researched at all.
woo curiosity lands tonight
 
@Jocelyn .. and why do you think we have the "closevote" thing pinned in the favorites list .
though to participate you would need 4k reputation
 
@Lusitanian same thing for me, there are too many people who just post things like "I want to do that and tell me how I can.".
 
And the people who just will never. ever be able to program
I know I sound elitist in saying that...but it's like people who will just never get good at athletics
 
@tereško: yes, closevote allows to remove some bad questions, but some remain on the site.
 
1:47 AM
That replace function is doing nothing ><
 
@KianMayne okay...it really shouldn't be that hard for you to figure out how to do this though
you aren't even adding the element correctly though, the DOM exists for a reason
 
Yeah I'm figuring it out
 
it's to prevent manual escaping and whatnot
 
@Lusitanian , @KianMayne .. take it to the javascript chat room
 
Well I'm going to bed
So bye
 
1:51 AM
it's late in UK. Good night
I'm going to bed too, it's late for me as well...
 
user895378
PHP manual awesomeness from stream_get_meta_data ...
 
user895378
 
user895378
Good to know.
 
@rdlowrey LOL
Anyone else besides me used Sami to generate docs?
I like it waay better than phpdocumentor -- just easier to use
nicer default template
 
sounds like you have been digging in semi-low level functions
i guess this part of API was exposed for debugging purposes
 
what does cv-pls mean?
 
please close vote
 
oh, okay.
 
indeed
@rdlowrey the Artax repository is my most frequently visited site now
because i repeatedly check to see if you've commited
guzzle makes me want to throw up because i guzzle so much to use it ): (which makes no sense)
 
user895378
@Lusitanian hehe, well I haven't yet. I'm doing come cleanup right now.
 
user895378
2:18 AM
I will at least push a functioning commit before I go to sleep tonight.
 
nice, i'll use it tomorrow then
 
user895378
There's no way I'll be able to test everything fully, though. That will commence tomorrow.
 
or if i'm up...i'll use it tonight
i need to write a shitload of tests with @PeeHaa before i put this oauth lib into composer/packagist
and probably implement oauth1
 
user895378
But I haven't been able to break it yet ... not with SSL or chunked encoding or compressed entity bodies or any combination of anything.
 
...and have a stable http client (:
nice!
i'll benchmark it next to curl and the stream wrapper
 
user895378
2:20 AM
I could care less about the benchmarks -- it works and has a clean API that makes sense and doesn't require any dependencies.
 
I know, i'm just curious about how performant it is because I'm guessing it's way faster since it uses sockets natively
rather than going thru 8000000 abstraction layers to get to curl.fucking.exe
 
morning all
 
user895378
hola
 
evening
salve
 
 
1 hour later…
3:34 AM
@rdlowrey Still up?
By the way, PHP.net has 5 mirrors running 5.4.5 .
Thank you.
And for the seven of you guys running 5.1.6 . . . come on, step it up.
 
user895378
@LeviMorrison Yeah, had to take a break to watch breaking bad.
 
You mentioned good progress earlier.
How good?
 
user895378
Awesome.
 
user895378
I'm adding some error handling now and should be able to push a preliminary working version (untested) in about an hour
 
user895378
maybe less.
 
3:41 AM
Also, we can maybe take test cases from Guzzle.
 
user895378
I've removed parallel requests temporarily and I'm going to get everything tested without it then add it back in.
 
user895378
I haven't looked at them, but if they make sense, sure.
 
Their library seems absolutely huge for an HTTP request lib, but maybe they at least have good test cases.
Maybe not
 
user895378
It would be really easy to add plugin capability by injecting a mediator instance but I want to keep the packages standalone, so I need to think about what to do in that area ...
 
By the way, I think Guzzle is a good example of a project with WAY too many classes.
 
user895378
3:45 AM
I honestly haven't looked at any of their code. I just looked at the feature list at the top of this page to make sure we could do all of it: guzzlephp.org/tour/http.html
 
hahaha, check this out:
    public function testIsClientError()
    {
        $response = new Response(403);
        $this->assertTrue($response->isClientError());
        $response = new Response(200);
        $this->assertFalse($response->isClientError());
    }

    /**
     * @covers Guzzle\Http\Message\Response::isError
     */
    public function testIsError()
    {
        $response = new Response(403);
        $this->assertTrue($response->isError());
        $response = new Response(200);
        $this->assertFalse($response->isError());
^ Most thorough test cases ever.
 
user895378
My guess is that those are there to get 100% coverage on exception classes with no behavior. I think it's dumb to do that -- I just tell phpunit to ignore classes with no body when calculating coverage instead of making up bogus test cases like that.
 
user895378
Nevermind, Guzzle\Http\Message\Response::isError is actually a method.
 
user895378
That's stupid.
 
Well, I've thought about adding one.
 
user895378
3:48 AM
I have some issues with their implementation as well ...
 
Something along those lines, I mean.
 
user895378
> Supports GET, HEAD, POST, DELETE, OPTIONS, PUT, and TRACE methods
 
user895378
You helped me realize that HTTP is extendable. That limits its capabilities
 
user895378
Also ...
 
user895378
> Persistent connections are implicitly managed by Guzzle, resulting in huge performance benefits
 
user895378
3:50 AM
The very article it links to say that mentions:
 
user895378
> It has been suggested with modern widespread high-bandwidth, low latency connections, Keep-Alive might not be as useful as it once was.
 
user895378
Also:
 
user895378
> Using persistent TCP connections can potentially speed up HTTP requests - but in most use cases, will have little positive effect and might overload the HTTP server you are connecting to. It is recommended to use persistent TCP connections only if you connect to the same server very frequently, and are sure that the server is capable of handling a large number of concurrent connections.
 
user895378
That said, persistent connections are used by default (except if you do an async request)
 
user895378
3:52 AM
It may be worth adding an option setter method to turn off persistent connections. I can do that later, though.
 
Going to read w3.org/TR/UAAG20 now.
 
user895378
Yeah, I haven't done it yet either :) I'll do the same.
 
It might not be relevant.
 
user895378
Actually, I'll wait and see what you say so I can get this pushed.
 
It's not about HTTP really at all.
More about browsers.
Also, 3/4 of US php.net mirrors are running PHP 5.2.x
How sad.
 
user895378
3:57 AM
That is sad.
 
I appreciate them donating bandwidth - I'm sure they are hit harder than any of the rest.
Ah, my mistake.
One of the previously mentioned mirrors is on 5.3.2
But that's still pretty sad.
One of them is on 5.2.4
And is the third lowest version in use.
Also is among the bottom 9/107.
 

« first day (660 days earlier)      last day (4285 days later) »