815 reputation
314
bio website software-talk.org
location Germany
age 27
visits member for 2 years, 8 months
seen 1 hour ago

-.-


2h
asked Safety in Access Control Matrix and Take-Grant Model
Nov
2
answered What to do about “approved” direct banking MITM sites like sofort.com?
Oct
27
answered Sequential password updates
Oct
26
comment Does this simple function add something to prepared statements?
Your question is if this function in addition to prepared statement is sufficient, right? If it is, I think you should rephrase your title to reflect this, otherwise you might get a lot of answers telling you that the function by itself is not sufficient. About multi-byte charsets: if you use PDO and either big5, cp932, gb2312, bgk, or sjis, you might be interested in this post.
Oct
22
comment How to exploit this include_once vulnerability in PHP?
@jyzuz you are right, cat /etc/nonexisting/../passwd does not work in bash. lang=nonexisting/../../echo on the other hand works (at least for me, with your example code andecho.php being in the same directory as the file containing that code).
Oct
22
comment How to exploit this include_once vulnerability in PHP?
@jyzuz so even when you are logged in via ssh you cannot for example do this: cat /var/log/../../etc/passwd? That could be a problem, yes.
Oct
22
answered How to exploit this include_once vulnerability in PHP?
Oct
22
revised Stored Cross-Site Scripting Without Parentheses or Spaces
added 370 characters in body
Oct
22
answered Stored Cross-Site Scripting Without Parentheses or Spaces
Oct
20
revised XSS - Bypass this RegExp
added 677 characters in body
Oct
20
answered XSS - Bypass this RegExp
Oct
12
answered Is it dangerous for apache error_log to be writable?
Oct
11
awarded  Custodian
Oct
11
reviewed Approve suggested edit on Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?
Oct
11
answered Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?
Sep
29
revised Does a random set of secondary passwords add any security?
added 175 characters in body
Sep
29
revised Does a random set of secondary passwords add any security?
added 376 characters in body
Sep
29
answered Does a random set of secondary passwords add any security?
Aug
30
comment How secure is this method to remember security questions?
I would definitely save it. Some sites not only use these questions for password recovery, but also in random intervals or on special actions as "additional security". So you will have a problem if you didn't write it down.
Aug
30
comment How secure is this method to remember security questions?
do you have any information on how most sites handle the confidentiality of the answers? Because my guess would be that they would not hash it, so that an approximate answer could be used as well (like on the phone: I went to albany high, Do you mean Albany High School?).