(adsbygoogle = window.adsbygoogle || []).push({}); Most of you have started using, or have being creating some sort of php, for fun, or just for testing purposes. Most of you have vulnrable scripts though. In this tutorial I will be showing you how to sanitize your scripts for safety

To start off...

here is your basic html:

    

<form name="login" method="post">

Username:

<input type="text" name="username"/>

Password:

<input type="password" name="password"/>

<input type="submit" name="submit"/>

</form>

here is probably your php code.

    

$username = $_POST['username'];

$password = $_POST['password'];



if (isset($_POST['submit']))

{

$set = mysql_query("SELECT * FROM table WHERE username = '".$username."' and password = '".$password."'

$set2 = mysql_num_rows($set);

}



if ($set2 < 1){

echo "no login";

}else{

echo "yes login";

}

now the $_POST is unsafe. that allows any attacker to put any information or unwanted chars into your script.

you want to use sanitasion.

here are a few examples:

we'll just use username in these examples

    

$username=trim($username);

$username=htmlspecialchars($username);

$username=mysql_real_escape_string($username);

trim will eliminate the spaces in the post to allow safe login.
htmlspecialchars will eliminate < > | { } etc.. and put it in hexadecimal so prevent XSS, RMI, and LMI
mysqlescape string will eliminate / to prevent mysql injection.

no you want to incorperate will all POST variables in your script.

but that is not all. you still want to verify your data. such as if it is an email $_POST you want to verify that it is an email.

$verify = filter_var($email, FILTER_SANITIZE_EMAIL);

then it will use verify.

so make sure your safe verifying your data, and I hope you learned something here.



BONUS: ENCRYPTING YOUR PASSWORDS

lets say you have your registration script active. but in your database it's in plain text
we'll be encrypting it.

now there are a couple of encryption's we'll just use the basic:
1. md4
2. md5
3. sha1

there are harder ones, but most hosts don't support them.

the code is quite simple. just put what you want.

    

$password = md4(md5(sha1($_POST['password'])));

just have that in your registration . you can change the encryption anyway you want. even use it more than once.

$password = md4(md4(md5(sha1(md4(md5(sha1(sha1($_POST['password']))))))));

note: it slows down your server with so much encryption..

now in your login script:

    

$password = md4(md5(sha1($_GET['password'])));

note: make sure the encryption in login is same as database/registration

simple as that, connect to your database and you're done!

you might have noticed get instead of post. this is because post will not work with encryption. idk why. ask php 5.0+ developers.. haha.

enjoy these tutorials, and stay classy NGU

php does have md4. I have used it before. maybe it was already on server idk..

md5 is safe enough.. vBulletin uses it haha (note: your database shouldn't be stolen in the first place anyways...)

htmlspecialchars does return to hexidecimal. check it out such as < would go to &nsp (idk code exactly) but in hex editor it returns <.

idk that's what I read, and tested it :p

but yeah this is just VERY basic. I know they are flaws, and that script was an example. this is for beginners, and if you have a better idea, make a thread yourself

oh my god.

vBulletin uses md5. so you're saying it's not safe. tell that to them. you database should be obtained in the first place. that's error of the user.

360 boom.

I found out my old host had the md4 function built in. sorry for the confusion there.

lastly I read that's what it turns into. I guess it's not. I know what hex ****ing means im not dumb. Just never tested if it was true.
It turns it into text so it can't be exploited...

site.com/?file=<

turns into

site.com/?file=&ns (w/e it is)


your all ****ing defensive and pissing me off jesus christ. don't bother replying go make your ****ing thread...

I am. he doesn't have to be an ass about it.

all my shit works except for the md4, and the thing about htmlchars not being hexdecimal.