New answers tagged

0

Your original problem is about a weak WiFi connection. This is not related to security of the WiFi access point. However, I will answer the question posed in your title - How to secure a wireless access point (AP) from unauthorized access. The below two points are good for a start: Use WPA2 encryption which is the strongest and most current method ...


3

However if you took that search string update aTable set someColumn='JackedUpValue' where someColumn like and performed the operation shown in this question, wouldn't you get updateaTablesetsomeColumn='JackedUpValue'wheresomeColumnlike which should not execute, right? As others have pointed out there are other ways of getting whitespace into ...


13

No. Let's say you have this as your SQL: "select * from people where last_name = '" + surname + "'" If I enter: 'OR(1=1)OR'a'=' into the input it turns into: select * from people where last_name = ''OR(1=1)OR'a'='' Which executes in Oracle and MySQL (at least) and returns all the rows from the table.


18

It would limit the problem, but not eliminate it. Consider the following situation: $un = str_replace(" ", "", $_POST["username"]); $pw = hash($_POST["password"]; $sql = "SELECT * FROM users WHERE username = '$un' AND password = '$pw'"; Lets say I post the username admin'--. That would log me in as admin, without using a single space. As wireghoul points ...


107

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied input unsafely in a query: http://example/index.php?id=1 => SELECT * from page where id = 1 In your example the attacker would use spaces: http://example/index....


46

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other type of data binding. Prepared statements separate the query from the data, making it impossible for the data to affect the query. To directly answer your ...


0

Unfortunately, even today there are some major companies where a human customer service agent asking you (whether via chat, phone, or other means) to tell them your PIN, password, or passcode is a regular practice. To take one very prominent category of these situations here in the U.S., when you call customer service for one of the big four national mobile ...


2

I totally agree with the answer by @ChrisTsiakoulas that your action is justified. However, sadly, this practice is not quite as uncommon as we would all like. I intend this answer to add a bit more colour to the real-world situation with such practices. I have come across the exact scenario you describe, although it was with a "proper" password (referred ...



Top 50 recent answers are included