« first day (660 days earlier)      last day (4300 days later) » 

2:01 PM
It is only small step from the Google+ API documentation to the Google search site. A very small one. I think if you combine the two, you will get exceptional results. — hakre 7 secs ago
ducking away now.
 
Who started that "external include" meme and why does everyone think it's awesome? stackoverflow.com/questions/11829689/…
 
Hello Hakre
I have been trying since yesterday to protect my website without success
 
I tried to add "mysql_real_escpae_strings" for each "_GET" variable, but when I did that, it stopped to work
 
I don't know why but for some reasons sometimes I have problems with mysql_real_escape_string, try just mysql_escape_string
 
Hi Alec, I will try that
 
@Darkeden Is there a reason you aren't using PDO / mysqli?
 
Please, don't use mysql_* functions to write new code. They are no longer maintained and the community has begun the deprecation process. See the red box? Instead, you should learn about prepared statements and use either PDO or MySQLi. If you can't decide which, this article will help you. If you pick PDO, here is good tutorial.
 
@Whisperity I have issues between compatibility sometimes when I use the old mysql functions. I always try to use the newer ones but if they don't work I give the older ones a shot.
 
@Alec Also, mysql_real_escape_string needs a previously opened (mysql_connect()) connection or a link identifier as a second parameter for it to work, as the escaping is done by the database server, not PHP.
 
2:11 PM
Anyone using Redis with PHP? (Predis or the likes?)
 
I'm not programmer and I don' know how to do that.
I'm trying, but I am not being able to implement them....
Also, my website is under attacks.
 
Is it bad if I don't know what Redis is?
 
Not at all. It's a key value store, reputed for really good speeds.
 
@Darkeden ofc it is. That's why you should use prepared statements and PDO :P
 
2:13 PM
@Darkeden Don't use unfinished code in production. What sort of attacks are you talking about? Your code might be in the need of serious refactoring then if it needs mysql_escape_string() to work. Is the server you are hosting on updated?
 
@Whisperity I'm trying to escape "_GET" variables of my file "content.php", which loads inside "index.php" (index.php has command "include_once("db.php");)
yes, the host is updated.
The problem I have already noticed...bad code.
@PeeHaa I tried to make PDO, but I guess I'm doing wrong.
 
0
A: constants are not "populated" when including a file from different server

webartofunction cthulhu_include($url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $code = curl_exec($ch); eval($code); curl_close($ch); } Delivering.

 
@Darkeden have you tried following this tutorial?
 
This file, changes user password:

<?php
$user = strip_tags(trim($_POST['user']));
$code = $_POST['code'];
$captcha = $_POST['captcha'];
$pass = $_POST['password'];
$confpass = $_POST['confpass'];
$errorstr = "";
$errorstr = check_changepass($user,$code,$captcha,$pass,$confpass);
if($errorstr=="")
{
$sql ="call changepass('$user','$pass','$code')";
$rs = mysqli_query($conn,$sql) or die( mysqli_error($conn));
$recs = @mysqli_num_rows($rs);
if($recs>0)
{
$successstr = "SUCCESS!";
$url = "index.php";
 
mother of god
 
2:19 PM
stored procedures :D
 
This is if($errorstr=="")
{
$dbh = new PDO("sqlserv:Server=localhost;Database=myDB";"DB_username";"DB_pass");

$stmt = $dbh->prepare('CALL changepass(:p_user, :p_pass, :p_code)');
$stmt ->bindParam((':p_user', $user,PDO::PARAM_STR,45);
$stmt ->bindParam((':p_pass', $pass,PDO::PARAM_STR,45);
$stmt ->bindParam((':p_code', $code,PDO::PARAM_STR,45);
$stmt->execute();
$rs = mysqli_query($conn,$stmt) or die("cant change password");
$recs = mysqli_num_rows($rs);
This is the PDO I tried to make
 
First of all, you should try to ask a proper question on the main site. You might also try to share your code on GitHub or anything alike so we can check and help you to refactor it, but it sounds really smelly (pardon my senses being miswired).
> Why is the constant, which is supposed to be global, not "inherited" when including from a remote server?
 
@Darkeden: NEVER EVER EVER EVER EVER EVER EVER EVER EVER EVER EVER EVER pass a raw password to a database connection. Always hash it in your application, and then pass the hashed value to the database...
 
@hakre We need your silver bullets here.
 
IRC, what should I do?
 
2:27 PM
Oh god @Darkeden, with your misconfiguration of security, you hath summoned ircmaxell on us. Also, is Darkeden Genesis your website?
 
rad
happy Monday, guys
 
Would anyone mind telling me what I'm doing wrong here with my if statement? For some reason it always echoes invalid action.
$cmds=array("login","attendance", "addlunchmoney");
$action = mysql_escape_string($_GET['action']);
if($action != $cmds[0] || $action != $cmds[1] || $action != $cmds[2]) {
	if(isset($action)) {
		echo "<b>Error:</b>Invalid Action";
  }
}
 
@ircmaxell Never?
 
That's a SCCEE.
 
2:28 PM
oh f*, I thought it was Sunday :D
 
I'm detecting a hint of disapproval.
 
Nope
 
I'm completely lost...
I'm like:
"My site is being attacked.
Ok, I'm Google "how to protect against sql injections".
Fine, now I'm have found millions of ideas (mysql_escape_strin, PDO, mysqli, etc).
My code is very particular and I don' know neither where nor how to go into fixing my website."
 
you're already using mysqli. For a start, just add mysqli_real_escape_string to all strings that you're adding to the raw SQL statement.
 
@Alec you are using mysql_* functions, you are first trying to do stuff with $action and only after that you check whether it isset() and you could just use in_array()
 
2:31 PM
eventually, you should really look at converting to use prepared statements, but for now, it will suffice
 
@Darkeden Maybe you should try to understand what problem you're trying to solve first: The Great Escapism (Or: What You Need To Know To Work With Text Within Text)
 
BUT, don't store raw passwords ever...
 
@PeeHaa Ooh, must've accidentally added that when I was being clumsy pretty much adding it to every _GET, thank you.
 
@Alec NEVER use mysql_escape_string. Always use mysql_real_escape_string()
 
@ircmaxell You're just jelly that my code is pure cancer.
 
2:32 PM
huh?
 
I find it rather confusing that you spend quite some time on the internet yet you never get this stuff.
The memes, etc.
 
@ircmaxell So, should I add this: "mysqli_real_escape_string" before each $_POST/$_GET in my code?
 
@webarto Maybe we should just create a canonical answer for all array access questions (yeah it's a sad sad day for the internet)
 
@ircmaxell What could possibly go wrong?
 
@Darkeden for a start...
 
2:34 PM
660
Q: Best way to prevent SQL Injection in PHP

Andrew G. JohnsonIf user input is inserted into an SQL query directly, the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO table (column) VALUES ('" . $unsafe_variable . "')"); That's because the user can input s...

 
@ircmaxell I did that into and my site stopped to work.
 
@PeeHaa :( I said to him that he RTFM and use his brain, but it got deleted. Someone is nice.
 
rad
lol
 
@Darkeden stopped to work is not a valid error state.
 
2:35 PM
I escaped "_GET" variables of my file "content.php", which loads inside "index.php" (index.php has command "include_once("db.php");)
Then, when I tried to access any place of my site that talks to DB, it didn't loaded
 
You need to do that before the query, not at the start of the program. Do it literally right before you bind the variable to query...
 
Sigh
Unit testing an object that's primarially getters/setters is boring.
 
function showarticle()
{
global $conn;
$id = mysqli_real_escape_string($_GET['id']);
$class = mysqli_real_escape_string$_GET['class']);
if(is_numeric($id)&&is_numeric($class))
{
$sql = "update dd_article_br set points=points+1 where id=$id";
mysqli_query($conn,$sql);
I did this
 
@Darkeden and you can't see the problem?
 
2:38 PM
@ircmaxell Landing on Mars is boring. We CRASHED on Mars!
 
mysqli_real_escape_string($_GET['class']);

opss, I added (
 
rad
hahah
 
No, look up mysqli_real_escape_string. Look up the function signature
 
@Darkeden MySQLi has an object-oriented ($db = new mysqli(); $db->query();) interface too.
 
2:40 PM
@ircmaxell It's our way of getting back at Europe for making their big Higgs-Boson announcement on the 4th of July
 
function signature?
 
And I think we just crashed Wikipedia too
 
the arguments
@GordonM nah, it's been crashed for a while
 
() <- signature? this is the signature right?
 
string mysqli_real_escape_string ( mysqli $link , string $escapestr )
 
2:41 PM
@Darkeden No, the signature is the list of arguments it takes.
 
rad
oh poor Beagle 2
 
@Darkeden You may either mysqli_real_escape_string($link, $string); (if procedural) or $link->real_escape_string($string); (if object-oriented).
 
I should give signature then?
 
@Darkeden NO! Signature of a function means the argument list it takes, basically what @ircmaxell said.
 
why do you people waste your time & nerves?
 
2:44 PM
How you called the function is wrong. You should have called, assuming $conn is the database connection pointer, mysqli_real_escape_string($conn, $somestring);.
 
I just realized his name isn't Darkened spelled wrong but Dark-eden. man I need to get more sleep
 
PHP is not Python, Ruby, JavaScript, C# or Haskell, from which evidentially follows that it sucks. Q.E.D.
 
Whisperity,

$id = mysqli_real_escape_string($conn, $id($_GET['id']));
 
Is there a command in MySQL to add to a int in the database without having to grab it locally in the PHP and add it there?
 
no...it's wrong
 
2:47 PM
@Alec You mean increment? You can UPDATE myTable SET counter = counter + 1
 
@Darkeden . $id($_GET['id']) is what the hell. $id = mysqli_real_escape_string($conn, $_GET['id']);, I guess.
 
@MikeB Thank you.
@MikeB That'll work.
 
@NikiC: Q.E.D.?
 
posted on August 06, 2012 by Anthony Ferrara

Every developer who studies computer science (and most who haven't) has heard the phrase "Garbage In, Garbage Out" before. It's such a logical concept that it's almost beyond refuting. Almost. While the phrase still definitely holds true for some situations, it doesn't hold for most. How can such a logical and straight forward saying lead us down the wrong path? Read more »

 
@Alec UPDATE table SET int_column=int_column+1 WHERE (condition goes here)
 
2:49 PM
Amazing
 
@hakre quod erat demonstrandum ;) you didn't have latin?
 
UPDATE `members` SET lunchmoney = lunchmoney + $lunchaddvalue
Is that valid?
 
@hakre quod erat demonstrandum... it's like "proving my point"
 
amazing! it works, no error this time.
Does it guarantee my website security?
 
"which was to be demonstrated"
 
2:49 PM
@Leigh I've always heard of it as Quite Easily Done
 
@Alec Yes, apart from being wide open to an SQL injection ;)
 
@ircmaxell thank you, whisper explained how to do this, it worked perfectly
 
@GordonM What if I cleanstrings and parse it so only numbers are inserted?
 
@ircmaxell we had a TV series in the UK called Q.E.D, they did sciencey things, which is probably how I learned it.
 
@Alec Yeah, assuming you do proper validation and sanitization of $lunchaddvalue you'll be fine.
 
2:51 PM
I think the latin version is more correct, but I like Quite Easily Done... It puts a different spin on it
 
@ircmaxell That's because you are american ;)
 
Yeah, that's true. I do have an american flag tattooed on my arm...
 
you also have your own metrics system, so why shouldn't you have your own translation of latin? ^^
 
UPDATE members` SET lunchmoney = lunchmoney + ($lunchaddvalue * -1)` <- Because there should be such a thing as a free lunch!
 
No, I know and understand the metric system. I also understand the imperial system. I can use both interchangably...
 
2:54 PM
@ircmaxell You know things like, yards in a mile? feet in a furlong? :)
 
Yards in a mile? 5280 feet per mile, 3 feet per yard, so 1760 yards per mile. I never use furlong...
 
pound per square-elbow? :P
2
 
furlong is archaic :P, it comes from the words furrow + length, which is how long a farmer would plough for, it's 660 feet
 
What about nautical miles?
 
Nobody but horse racing affectionados use furlongs these days.
 
2:56 PM
but I mean I can interchange most metric units and understand them first-class. Meaning without having to do a conversion in my head.
 
@Darkeden Nothing guarantees full security. We can make our best to break down the range of possible attack, but nothing will guarantee full security.
 
1,852 metres (approximately 6,076 feet).
 
@ircmaxell I think we all knew what you meant, I was being pedantic.
@GordonM aha of course, the final furlong :)
 
@SomeKittens: 1609.344 meters per mile... Exactly
 
I had a slightly weird education and use a mish mash of metric and imperial. Though US imperial confused the hell out of me the first time I was there, asked for a pint and got a tiny little thing back. Here a pint is 20 fluid ounces but it's apparently 16 in America!
 
2:58 PM
nice
 
I always remember 2.54cm to the inch, although I never remember it as 25.4mm
 
1 cup is 8 ounces. One pint is 2 cups. One quart is 2 pints. One gallon is 4 quarts.
 
The nice thing about the pint difference is that it doesn't really matter after the third or fourth drink
 
the hacker is kidding me.
He came to me and said he was attacking my site.
Then, he said how he was doing that and what should I search in order to avoid that (sql injections).
Right after he said, "as soon as you close this hole I'll keep attacking it by other holes."
 
We also have an informal "metric foot", which is exactly 30 cm
@ircmaxell We have bigger cups :)
 
2:59 PM
@Whisperity he is messing accounts of other users...
 
@ircmaxell thats US pints, which are inferior
 

« first day (660 days earlier)      last day (4300 days later) »