New answers tagged mysql
It's a problem of web page design/implementation. If it's bad designed (composing SQL statements on the fly mixing them with written literals) SQL injection issue exists. If it's well designed there is no way to do that attack.
You could start by reading about some (Ubuntu specific) best practices. Like: Closing unnecessary ports. Removing unnecessary packages. Setting up some basic iptables rules. Setting up a Web Application Firewall like mod_security. Look into DNS solutions like CloudFlare to prevent heavy load on your VPS processes in case of DDoS-attacks. Working with SSH ...
There are currently three accepted password hashing algorithms (note the difference between encryption and hashing!): pbkdf2 bcrypt scrypt So you can use either of these three. PBKDF2 is the most supported. Storing passwords in a reversible way is considered bad practice.
Backups don't really have anything to do with preventing or mitigating DDOS attacks. A DDOS attack will prevent people from accessing your site, it doesn't have anything to do with the destruction of data. So to answer your question, no - I don't think setting up backups will help you in the event of a DDOS attack. That said, regularly backing up data ...
It looks like the server has php configured with magic quotes on. Since the example query provided doesn't contain any quotes you won't need to inject any quotes. Something like 1 union select @@version from shop -- - should give you an error about unions needing the same number of columns, proving the injection.
Top 50 recent answers are included