Basic Security Mesuares

[Jake]

I am using DBS (MC) Code Lite, with all additional features coded by myself, if you wish to see, go to: www.the-liberation.com. Over the past 2 months we have had terrible issues with hacking...Well I think anyway. The problem is i don't know how the 2 people that are doing this are getting into the server/or even what they're doing.

The First thing i noticed was millions of dollars on their accounts, then about 3 Billion Dollars worth of items etc... so i presumed SQL Injection, i have made my site secure against this now, but the problems still go on...So i checked files for the 0.4E935343 problem, and there it was, on the page where Gang Leaders Give money to members, there was this error. So i cleared this up, but still there were things annoying me: These Hackers were level 20, without attacking anyone, or training or committing any crimes. Other players have also noted that they're levels went up and that the house they were in changed.

Now i have a sophisticated database system and there is no way they could tell what the table names/field names were for all of these aspects...which leads me to believe it Must be hacking. So do any of you know of any issues in the code that caused this, or are they gaining access to my server?

Is there any open ports or things like that? I don't know how to test for these, so any information would be very valuable.... What are basic Security Mesuares i should take...

[Niteshade]

Re: Basic Security Mesuares

Is it an internal problem? Are you sure you don't have admins that are editing user stats?

[Guest Anonymous]

Re: Basic Security Mesuares

Well han,t u got sql injection protection thats the 1st setp i think

[montyash]

Re: Basic Security Mesuares

has any got the sql injection code because i lost mine n i keep getin hacked lol plzzz help

[Isomerizer]

Re: Basic Security Mesuares

 

has any got the sql injection code because i lost mine n i keep getin hacked lol plzzz help

function antisql($String) {

if (ini_get('magic_quotes_gpc') == 'off') $String = addslashes($String);

$String = htmlentities($String, ENT_QUOTES);

$String = mysql_real_escape_string($String);

return $String;

}

?