Re: [PHP] SQL-Injection, XSS and Hijacking

2004-11-05 Thread Chris Shiflett
--- Jordi Canals <[EMAIL PROTECTED]> wrote: > > I highlight some of the things I think are of principal concern > > for PHP developers in something I call the PHP Security Workbook: > > > > http://shiflett.org/php-security.pdf > > > > That doesn't cover everything, of course, but it covers those

Re: [PHP] SQL-Injection, XSS and Hijacking

2004-11-05 Thread Jordi Canals
On Wed, 3 Nov 2004 19:02:22 -0800 (PST), Chris Shiflett <[EMAIL PROTECTED]> wrote: > There is a lot more. I highlight some of the things I think are of > principal concern for PHP developers in something I call the PHP Security > Workbook: > > http://shiflett.org/php-security.pdf > > That doesn'

RE: [PHP] SQL-Injection, XSS and Hijacking

2004-11-05 Thread Pedro Iran Mendez Perez
Hello Mark, Where can I find these articles that you talk? do you have a URL for those articles? Thank you :) = "?Acaso se olvidara la mujer de su bebe, y dejara de compadecerse del hijo de su vientre? Aunque ellas se olviden, yo no me olvidare de ti" Isa 40:27 = Atte Pedro Iran Men

Re: [PHP] SQL-Injection, XSS and Hijacking

2004-11-03 Thread Chris Shiflett
--- [EMAIL PROTECTED] wrote: > I read now quite a lot of articles about SQL-Injection, > XSS, and session hijacking in a hopefully appropriate way. > > As I understand the function addslashes(), quote_meta(), > and mysql_real_escape_string() are to avoid SQL Injection The database-specific escapi

RE: [PHP] SQL-Injection, XSS and Hijacking

2004-11-03 Thread Zareef Ahmed
Hi, look for escapeshellcmd(). It is another good function to minimize the security risks. http://in2.php.net/escapeshellcmd Zaeeef ahmed >-Original Message- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] >Sent: Thursday, November 04, 2004 3:55 AM >To: [EMAIL PROTECTED] >Subject: