Theory of Automata's solutions have been uploaded in this post.
Click Here to get Automata's Solutions!

MySQL - sql injection prevention

sql injection example

// a good user's name
$name = "timmy"; 
$query = "SELECT * FROM customers WHERE username = '$name'";
echo "Normal: " . $query . "
";

// user input that uses SQL Injection
$name_bad = "' OR 1'"; 

// our MySQL query builder, however, not a very safe one
$query_bad = "SELECT * FROM customers WHERE username = '$name_bad'";

// display what the new query will look like, with injection
echo "Injection: " . $query_bad;

Display:

• username = ' '

• username = ' ' OR 1

more serious sql injection attacks

$name_evil = "'; DELETE FROM customers WHERE 1 or username = '"; 

// our MySQL query builder really should check for injection
$query_evil = "SELECT * FROM customers WHERE username = '$name_evil'";

// the new evil injection query would include a DELETE statement
echo "Injection: " . $query_evil;

Display:

injection prevention - mysql_real_escape_string()

//NOTE: you must be connected to the database to use this function!
// connect to MySQL

$name_bad = "' OR 1'"; 

$name_bad = mysql_real_escape_string($name_bad);

$query_bad = "SELECT * FROM customers WHERE username = '$name_bad'";
echo "Escaped Bad Injection: 
" . $query_bad . "
";


$name_evil = "'; DELETE FROM customers WHERE 1 or username = '"; 

$name_evil = mysql_real_escape_string($name_evil);

$query_evil = "SELECT * FROM customers WHERE username = '$name_evil'";
echo "Escaped Evil Injection: 
" . $query_evil;

Display:

• Bad: \' OR 1\'
• Evil: \'; DELETE FROM customers WHERE 1 or username = \'

//------------------------------------------------------------------------
// This file depends on:
// http://gmail.google.com/gmail?view=page&name=browser
//------------------------------------------------------------------------

//------------------------------------------------------------------------
// Some browser detection logic.
// Once http://gmail.google.com/gmail?view=page&name=browser has these
// variables as *global* these definitions can be deleted.
//------------------------------------------------------------------------
var agt = navigator.userAgent.toLowerCase();
var is_op = (agt.indexOf("opera") != -1);
var is_ie = (agt.indexOf("msie") != -1) && document.all && !is_op;
var is_ie5 = (agt.indexOf("msie 5") != -1) && document.all && !is_op;

//------------------------------------------------------------------------
// Communication with server
//------------------------------------------------------------------------

function CreateXmlHttpReq(handler) {
var xmlhttp = null;
if (is_ie) {
// Guaranteed to be ie5 or ie6
var control = (is_ie5) ? "Microsoft.XMLHTTP" : "Msxml2.XMLHTTP";

try {
xmlhttp = new ActiveXObject(control);
xmlhttp.onreadystatechange = handler;
} catch (ex) {
// TODO: better help message
alert("You need to enable active scripting and activeX controls");
}

} else {

// Mozilla
xmlhttp = new XMLHttpRequest();
xmlhttp.onload = handler;
xmlhttp.onerror = handler;

}

return xmlhttp;
}

// XMLHttp send POST request
function XmlHttpPOST(xmlhttp, url, data) {
try {
xmlhttp.open("POST", url, true);
xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8");
xmlhttp.send(data);

} catch (ex) {
// do nothing
}
}

// XMLHttp send GEt request
function XmlHttpGET(xmlhttp, url) {
try {
xmlhttp.open("GET", url, true);
xmlhttp.send(null);

} catch (ex) {
// do nothing
}
}

This is a Mind reader software...
Similar to www.peteranswers.com having same criteria..
It tells about answers you give him!
For Example: If you ask about your name then it will tell your name...
Its 100% true you just have to give it time!
First of all Request, then Question him!
after it, it will show you the desired results!
Click here ----> MindFreakShahwaiz.exe to download the Software!
Thankx! Keep visiting! :-)

International Scores: "Get the latest scores of all the international cricket matches from Cricinfo.