Rotutorial
www.rotutorial.3xforum.ro Aici gasesti Tutoriale Photoshop,MUonline,Counter-Strike,HTML,PhP,CSS,si multe altele

Nou pe simpatie:
danutza_84

Femeie
25 ani
Galati
cauta Barbat
26 - 55 ani

Rotutorial Inregistrare Login PozeNu sunteti logat. Lista Forumurilor Pe Tematici

Rotutorial / IT Security /

mod de aparare xss, sql

Pagini: 1

Admin
Administrator
Postari: 67

am implementat intr-un site aceste functii.

functie ce poate fi folosita la filtrare impotriva xss.
daca observa ca unul dintre caracterele 'evil' a fost filtrat face si logare.

Code:

function filterCross($filterMe)
{
   $tempMe = $filterMe;
   $filterMe = str_replace("<", "&lt;", $filterMe);
   $filterMe = str_replace(">", "&gt;", $filterMe);
   $filterMe = str_replace("(", "(", $filterMe);
   $filterMe = str_replace(")", ")", $filterMe);
   $filterMe = str_replace("#", "#", $filterMe);
   $filterMe = str_replace("&", "&", $filterMe);
   $filterMe = str_replace("\"", "", $filterMe);
   $filterMe = str_replace("\'", "", $filterMe);
   
   if (strcmp($tempMe,$filterMe))
   {
      logHacker();
   }
   return $filterMe;
}

functia care log-eaza request-ul unui user, preferabil hacker:

Code:

function logHacker()
{
   $link =        mysql_real_escape_string($_SERVER['PHP_SELF']);
   $useragent =   mysql_real_escape_string($_SERVER['HTTP_USER_AGENT']);
   $referrer =    mysql_real_escape_string(getenv ('HTTP_REFERER'));
   $ip =          mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
   $env =         mysql_real_escape_string(var_export($_ENV, true));
   $cookie =      mysql_real_escape_string(var_export($_COOKIE, true));
   $get =         mysql_real_escape_string(var_export($_GET, true));
   $post =        mysql_real_escape_string(var_export($_POST, true));
   $session =     mysql_real_escape_string(var_export($_SESSION, true));
   $globals =     mysql_real_escape_string(var_export($GLOBALS, true));
   $date =        time();
   
   $queryInsertHacker = "INSERT INTO hackers "
   ."(link, useragent, referrer, ip, env, cookie, get, post, session, globals, date) "
   ."VALUES ('".$link."', '".$useragent."', '".$referrer."', '".$ip."', '".$env."', '".$cookie."', '".$get."', '".$post."',"
   ."'".$session."', '".$globals."', '".$date."')";
   
   mysql_query($queryInsertHacker);
}

sql pentru crearea tabelei 'hackers'

Code:

CREATE TABLE IF NOT EXISTS `hackers` (
  `ID` bigint(20) NOT NULL auto_increment,
  `link` text NOT NULL,
  `useragent` text NOT NULL,
  `referrer` text NOT NULL,
  `ip` varchar(15) NOT NULL default '',
  `env` longtext NOT NULL,
  `cookie` longtext NOT NULL,
  `get` longtext NOT NULL,
  `post` longtext NOT NULL,
  `session` longtext NOT NULL,
  `globals` longtext NOT NULL,
  `date` bigint(20) NOT NULL,
  PRIMARY KEY  (`ID`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=151 ;

ca sa scapi de sql inject poti sa faci:

Code:

$_GET = array_map("mysql_real_escape_string", $_GET);
$_POST = array_map("mysql_real_escape_string", $_POST);

ca sa folositi functia filterCross pe tot $_GET si $_POST puteti sa faceti:

Code:

$_GET = array_map("filterCross", $_GET);
$_POST = array_map("filterCross", $_POST);

sau doar pentru o variabila:

Code:

$variabila = filterCross($variabila);

deci este atat de simplu.

bineinteles, uneori vrei sa fie lasate unele caractere sa treaca

Pagini: 1

Mergi la