3 ms·
1)Memories of the older days where mysql_escape vs mysql_real_escape 2)It's 2014 and Drupal just got exploited by a sql injection attack. 3)Because of php's wea
by twunde 12y ago
1)Memories of the older days where mysql_escape vs mysql_real_escape
2)It's 2014 and Drupal just got exploited by a sql injection attack.
3)Because of php's weak typing, php will accept a lot of strange input such as arrays with variables in them. Which is weird and can lead to some remote code execution
4) If you're busy defending against xss and sql injection still who is defending against more esoteric attacks like csrf, denial of service, timing attacks, etc? (If you can tell me about csrf and have set up csrf protection in a project you're in the minority of php developers)
- sarciszewski 12y ago> (If you can tell me about csrf and have set up csrf protection in a project you're in the minority of php developers) Incidentally, I wrote this: https://github.com/resonantcore/lib/blob/master/src/Security/CSRF.php https://github.com/resonantcore/lib/blob/master/src/Security... #3 is surprising to me. I've seen some strange behavior (throwing [0] after a post field can lead to unexpected errors and sometimes lead to an information leak) but never RCE.