🦋 Passed the first test
So in my log I see a bunch of requests today for GET blog/?k=<keyword> \'\'
and(char(94)+user+char(94))>0 and
\'\'\'\'=\'\'
where <keyword> is one of the keywords that links exist to on the site; and also I see that my script translated those requests to
<keyword> \\\'\\\'
and(char(94)+user+char(94))>0 and
\\\'\\\'\\\'\\\'=\\\'\\\' before passing them to the database. So the queries just returned empty sets instead of wreaking whatever havoc they might have wruck unescaped. Yay PHP! Yay careful programming!(Note: but while editing this post I realized there is a different kind of escaping that you have to do when you are writing to forms -- the < and > signs were translating to markup in my inputs. Funny I never ran into that problem on the old site, you wouldn't think it would be a PHP-vs.-ASP distinction.) Update: So what do I have to do to ban these guys from my site? I tried putting the following in my httpd.conf: <Directory (path to root of my site)>
order allow,deny
deny from (IP)
deny from (IP)
allow from all
</Directory>
and restarting the service, but that does not seem to have done it.Another Update: I think I got it: the Directory directive in apache2/sites-available/default is overriding the directive in httpd.conf because httpd.conf is included first. I think I just need to take the default directive out.
posted evening of Friday, October 12th, 2007
➳ More posts about The site
➳ More posts about Programming Projects
➳ More posts about Projects
➳ More posts about Programming
| 
