3 ms·
As a person who teaches PHP (and probably other languages too), you should definitely tell people not to do following mistakes: mysql_query("INSERT INTO tabl
by pstadler 15y ago
As a person who teaches PHP (and probably other languages too), you should definitely tell people not to do following mistakes:
mysql_query("INSERT INTO table(field) VALUES('".$_POST['input']."')");
and not to forget, a truly classic one:
include('pages/'.$_GET['page']);
When I started to learn PHP there was a contest between the students: Who brings hosts with vulnerable websites down faster. The trick was to recusrively include the same page (like index.php for example). The most funny thing though was to see the explosively rising load average by including /proc/uptime.
After having some fun, we usually sent emails to the administrators just to not receive any answers and to find the hosts still vulnerable months later...
- pavel_lishin 15y agoI would consider e-mailing the administrators an e-mail with something along the lines of "<img src='http://vulnerable_host/?page=/proc/uptime http://vulnerable_host/?page=/proc/uptime />" "The call is coming from inside the house!"
- pstadler 15y agoIt was much more fun to send them their own /etc/motd!