PHP Tutorials: Security - SQL Injection

[TheRayesh]

Well explained !!!!!

[shikharsrivastava23]

please tell me which screen recorder do you use?

[jacky9103]

thx so much



[leoyt123]

LOL hack hacking hacker hackers are in the Tags

[MrC0MPUT3R]

UBUNTU FTW!

[stutlet]

The magic quotes feature DOES NOT DO THE SAME as mysql_real_escape_string. You handle it correctly when you add the code, but it's important to note that magic quotes does an addslashes, not a mysql_real_escape_string.

[abney317]

no more magic quotes? D: noooooooo

[vinayshah17]

very good explanation..thanks 

[SaluSnikoS]

Great Visual Tutorial... BAaaaaad accent.. gives u in the nerves..... Grrrrrr.... bloodyyy British....... hahahahahahhahahah...

[dbmarquand]

@threeclock

Yeah? What happens when they disable JavaScript inside their browser?

[gvrlprncp]

very nice, this was very useful for me ;)

[dizzylamb]

TOGETHER TO THE TOP!

[itpastorn]

@threeclock JavaScript is not for security.

Amother tip.

There is a better solution than mysql_real_escape_string and that is prepared statements, availabe for users of mysqli and PDO.

Unless you're working on a legacy system, one should use the better api!

[threeclock]

Just use JavaScript to validate the form before submitting.

[Grkgermn333]

By the way, you can also add another function:

mysql_real_escape_string(trim(­$_POST[ 'email' ] ) )

trim() removes leading and trailing spaces.

[Sagaterious]

Why do most of your SQL statement variables have { }?, I've never seen PHP modeled with them unless prefixed after a function.

[Grkgermn333]

@Sagaterious me too

[xXZarlachXx]

My login is made so that you can only enter numbers and alphabetic characters.

[daeheadshot]

@xXZarlachXx you did that with a javascript?

and can i have a link to your site ?

[xXZarlachXx]

@daeheadshot

I think it does something like @N1ghtSp33D said, checking from a-z A-Z and 0-9.

[daeheadshot]

@xXZarlachXx i was wondering because if you save the site and delete (for example) the javascript code that prevents you from entering the chars you want you can simply do the attack anyways.

[killerpacdot]

@daeheadshot Firebug is your friend.

[noel11105]

tnx for the video can you do php online rating and taking the voter's ip

[EnvXOwner]

Ubuntu :)

[N1ghtSp33D]

or just do a preg_match allowing a-zA-Z0-9-_

[harrei]

one could instead use PDO (PHP Data Objects) for interfacing with a database, like mysql for example.

PDO ships with PHP 5.1 and it's prepared statements eliminate any opportunity to change the logic of the SQL.

php(.)net/manual/en/intro.pdo.­php

[RabbitFactoryUK]

Great tut, very useful, thankyou :)

[n0b0dy241]

Wait.. i havent seen any site using id to login?

[JamesRCoston]

@n0b0dy241 It was just for demonstration purposes...

[wideload123]

@n0b0dy241 Just an example...

[NullDeveloper]

Use eclipse! X-Platform + BEST JAVA IDE made IN Java!

[wideload123]

@NullDeveloper I do for java, but this is not Java ;)

[MixedPasi]

Linux is the best!

Btw.: Netbeans is also available on Linux. ;)

[Cezarijus]

very informative, thank you.

[Techn0Junki3]

If you're going to use mysql statements at least use the mysqli class.

[brotherlu]

@Techn0Junki3 mysql is still faster than mysqli, though mysqli gives back by being more feature rich.

[GSNTube5]

are you using Ubuntu or Mac OS?

[wideload123]

@GSNTube5 Ubuntu.

[YoungBlood0893]

nice video, you're a really good teacher. you and bucky from newboston are great! keep it up

[Myztik7]

You should all be using prepared statements and avoid the mysql_* functions

[wideload123]

@PHPWizz It's me :)

[YaManTino]

@PHPWizz Yes.

[m0gria]

lol, "decrypting" the hash with john took 0 seconds :D

[alex26toma]

thanks for the tutorial

[heydude8999]

You should do tutorials on MySQL database optimization (performance..)

[theclevercoder]

@heydude8999 Agreed... that is one thing I would love to learn more about.

[MakeOrange]

I <3 your tut's

[FloobenShnooben]

Linux :D

[bartalveyhe]

watch?v=rdyQoUNeXSg

defcon 17 Advanced SQL Injection

this is what you can do whit SQL injections

[c0decub]

sanitize var

[MakUnited]

1st