Tag Info

Hot answers tagged

29

Answering your question mysql_query() doesn't support multiple queries as documented: mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier. Which means that DROP TABLE temp; -- is never executed. It is although possible if you use ...


22

I am not aware of any published cryptanalysis on MySQL OLD_PASSWORD(), but it is so weak that it is kind of a joke. It could be given as an exercise during a cryptography course. Update: a cryptanalysis similar to the meet-in-the-middle described below was published in F. Muller and T. Peyrin "Cryptanalysis of T-Function-Based Hash Functions" in ...


22

There isn't a good answer. But here are your possibilities: Tie the encryption key to your admin login (e.g. encrypt the the encryption key with your admin login). This is only marginally useful as it requires you to be logged in in order to encrypt/decrypt anything. But on the plus side, no one can encrypt/decrypt anything unless you're logged in (i.e. ...


21

Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services. Firewall - Limit access by IP address to only the servers / clients that require access. User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead ...


21

"None of us are security experts" and "I wouldn't feel comfortable with a company storing my credit card information in this manner" are completely valid arguments. From a technical perspective (on the merits), they ought to end the discussion. But if you're arguing with folks who are not security experts, they may not be in a position to recognize good ...


18

Storing card numbers means you must comply with the requirements of PCI-DSS, or you risk fines and breach of your merchant account contract. PCI-DSS has an enormous set of requirements - some sensible, some onerous, some of questionable usefulness - and the cost of complying with it, and certifying that you've complied with it, can be very high. Download ...


18

You've come to the right place. Welcome to IT security! is there any sql injection for this code? Yes if there is what is that Entry? username: [any username from your website]" /* password: sux0r")*/ OR ("1"="1 It will run this query: SELECT * FROM `config` WHERE `config_admin_username`="[any username from your website]" /* AND ...


17

In PHP you cannot stack querys with a semicolon. However you can nest a query into another with parentheses (commonly called subqueries), e.g.: SELECT * FROM vulnerable_table WHERE id = (SELECT number from other_table) Using this technique (disregarding whether you output your SQL result or not) a keen attacker may extract all data from your database. ...


14

Summary. Yes, the issue is that, in some character encodings (like UTF-8), a single character is represented as multiple bytes. One way that some programmers try prevent SQL injection is to escape all single quotes in untrusted input, before inserting it into their SQL query. However, many standard quote-escaping functions are ignorant of the character ...


13

You should use prepared statements to prevent SQL injections. Take a look at this question. However, $_SERVER['REMOTE_ADDR'] should be a valid IP address as it comes from the server, as verified by the TCP handshake. See this question for an extended discussion on this.


13

You just need to store the configuration in a file that is only accessible to the user that PHP is running as. You can prevent a web user from accessing the file, but PHP has to be able to get to the credentials and no matter what you do, they will be effectively unprotected. Any secret you could give the application could be discovered, so there isn't any ...


12

Generally hashing and encryption are for two different things. The main distinction in your case is that hashing is one way, and encryption is two-way. That is, you can decrypt the password to get them in plain text, but you cannot "de-hash" something. If your system gets compromised and you are using encryption, the attacker will probably have all the ...


12

The MySQL root user is an account inside the database only. It is called root because it is the most privileged user on the database server, and has access to everything. The root user on Linux (or any other Unix) is a completely separate thing. The maximum privilege that a MySQL user can have is equal to the privilege that the MySQL daemon runs at. On most ...


12

The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions. You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these ...


12

Short answer: It's damn vulnerable. Why? You are concatenating the values given by POST which come directly from what the user typed. Therefore, it is very simple to manipulate your query. Also, you are using mysql extension which is deprecated. You should be using mysqli or PDO to create prepared statements to protect against injection. Here's a question ...


11

To get started, you're probably going to want to focus on two things: Securing your web server Security your website That's really two different specialties, and I don't think I'm going to be able to dig up a single document describing both... the ardent security nerd would also point out that this assumes you're working in a secure network with decent ...


10

This is really a pretty stinking huge question. Based on your chosen tags it looks like you're asking for guidance on a LAMP stack, so we'll focus on that. There are already a number of related hardening questions posted, so for some additional insights check out these questions: MySQL Server Hardening Hardening Linux Server What are the best practices for ...


10

You forgot just one little thing: Password strength. Just 2 words which overweight whole your brilliant topic. There are indeed hundreds of topics on Stackoverflow telling you to use this or that hashing algorithm and random salts. And only very few explaining that with weak password all your eight-item-list protection, all extra secure ...


9

It is very good that the mysql server is not required to support remote connections because it greatly reduces the attackable surface. But you should consider defence in depth as a strategy to slow down an attacker or even reduce the impact of an attack. Setting up a good password for the database users is no significant amount of work, so you should do ...


9

It might be that the function you use in PHP does not allow stacked queries or because the user which is configured to perform the queries does not have drop table privileges. I suggest you log all the output and exceptions thrown by the application. It could give a clue where your problem lies. EDIT 1: Instead of executing the query, print it to the ...


9

The ‘high’ example is not exploitable. It's not a good approach (in modern code you would use parameterisation instead of calling mysql_real_escape_string, and stripslashes is a relic of an era of magical quotes that is thankfully over), but it is designed not to be immediately vulnerable. (To SQL injection anyway. It is vulnerable to HTML-injection leading ...


8

You should never put the password in the code. In general your connection settings live outside the compiled application code; for C# that would generally be in an app.config XML file, encrypted if need be. But either way, if the application is able to make direct connections to the database, it has to know the password, and there is nothing you can do to ...


8

If your company is in any way a part of regulations requiring security (like SOX or HIPPA in the US) or trade standards (like PCI or various ISO standards), all you have to do is tell them that: you've found holes that could let anyone download the entire database and network (stretch the truth a bit if you have to sell it, and remind them of the ACS:Law ...


8

Don't implement your own session handler. Use $_SESSION, it was written and audited by people who very good understanding security. I don't even know the intricacies of how your session handler works, but based on the little information you have given us its insecure. SQL Injection is useful to obtain data from the database. We HASH passwords because ...


8

Yes, for several reasons. One, someone with read access to the binary could potentially run the strings command and look for likely possibilities near the phrase 'localhost'. Two, if you ever decide to use the program elsewhere, you currently have the options of 1) setting up the exact same database on localhost with the exact same username and password ...


8

I find that ' or 1=1-- is useful in less than 1% of sql injection that I come across, this payload is commonly seen in SQL Injection examples because it is a very simple statement. The problem that you are most likely experiencing is that your comment is incorrect. The -- needs to follow by a single space or it is not actually a comment, so ' or 1=1-- 1 is ...


8

TildalWave has a great answer, but there is a great mediation to SQL injection that was missing from the answer. Prepared Statements. As Tildal said the entire statement with user input is parsed with no parsable distinction between variables and constant parts of the statement. The solution is sending the constant part of the statement with variable ...


8

If you use mysql_real_escape_string consistently every time you inject content into an SQL string literal, it's fine, there is no security issue. However what time has taught us is that: Catching every single place you inject into an SQL string literal is hard. In real world software unescaped cases are sometimes missed, even when the original coder ...


7

You are extending your trust to outsiders beyond your subnet neighbors. By default, MySQL uses unencrypted connections between the client and the server. This means that someone with access to the network could watch all your traffic and look at the data being sent or received. They could even change the data while it is in transit between client and ...


7

I suppose the usual OS methods (including fail2ban if remote ssh admin is required), then block all external access to the MySQL port, or allow a whitelist to connect if absolutely necessary. Set a password for the mysqladmin user. After that, the mysqladmin user should only be allowed to connect from localhost and should be the only user granted any ...



Only top voted, non community-wiki answers of a minimum length are eligible