Securing.

[Joshua]

A snippet of a functional working query on a demo site

 

$db->query("UPDATE `myplayers` SET `exp`=`exp`+%%u%%,`cash`=`cash`+%%u%% WHERE `userid`=%%d%%", $expgain, $stole, $userid);
$db->query("UPDATE `myplayers` SET `hp`=1,`cash`=`cash`-%%d%%,`hospital`=%%u%%,`hospreason`='Mugged by <a href=\'viewuser.php?u=".number_Format($userid)."\'>".strip_tags($ir['username'])."</a>, ' WHERE `userid`=%%u%%", $stole, $hosptime, $r['userid']);

[Jordan Palmer]

<?php
<a href=\'viewuser.php?u=".number_Format($userid)."\'>
?>

 

WTF!! lmao fail much?

[Zero-Affect]

Fatal error: Call to a member function query() on a non-object

query was:

[mysql]

UPDATE `godzilla` SET `column` = `column` + %%u%% WHERE `user` = %%d%%", 1, 1

[/mysql]

FAIL^

What version of MySQL are you running maybe it's unique to your version.

[Joshua]

Try adding ' ' around the %%%% as it isnt pitching an error on my end, nor the other site i tested it on, both on latest vers

[Zero-Affect]

Same issue once again, i believe only quotations are need when it's string?

[Joshua]

Not the latest version but close

MySQL version 5.0.89

Edit X's 2.

Normally yes, ' ' is just for strings, obviously. However, it failed for me until i added ' ' around the % as well.

----

Alan, You've destroyed countless games and you're not even an adult yet. God forbid when you can be held legally liable for the idiocy you provide to the general public. Wish I could be there.

[CrazyT]

Yes, you've been hacking and manipulating people the longest out of anyone, congratulations!

If it didnt work, then why is it working on my queries?

LMFAO! hacked? No - Exploiting kinda. :-D

Ermm, stop that a long time ago, and oh please don't try say you haven't because we all know you have.

Working on your queries, yes you've probably added, sprintf, or vsprintf, in the MC CODE DB CLASS. && Read back to my post, n00b! :D

[CrazyT]

Not the latest version but close

MySQL version 5.0.89

MySQL version 5.0.89-community

Umm same.... Yet failure again :)

[Joshua]

Focus more on studying than hacking maybe you could get it to work, I did, go figure that one?

[Zero-Affect]

Server version: 5.0.89-community

Same yet failed also...

Also guys remember this isn't a place to flame people

[CrazyT]

Focus more on studying than hacking maybe you could get it to work, I did, go figure that one?

No need, know more than you ^_^

Hacking No, Exploiting = Old.

So go back to php.net no WAIT you only can learn from other peoples coding? ^_^ MCCODES = failire = you ;]

[Zeggy]

I think as long as the output is secure you're fine...In some eye's I'll be wrong in my own I'm correct

Securing output protects from XSS. Securing input protects from SQL injections.

 

 

er file page you know what i meant.

[..] I dont wanna hear it from you, you didnt know that %u / %s %d do not NEED sprintf to operate ^_^ [/..]

As far as I am aware, that particular syntax is specific to the printf family of functions, unlike in python... If I'm wrong, where can you use this kind of string formatting?

 

So are you going to use your "new found" way or stick to the longer but most understanding way, Bet most people never even knew SprintF was a filter (notice the F in sprintF, printF, vsprintF).

The F stands for formatting, not filter ;)

 

A snippet of a functional working query on a demo site

 

$db->query("UPDATE `myplayers` SET `exp`=`exp`+%%u%%,`cash`=`cash`+%%u%% WHERE `userid`=%%d%%", $expgain, $stole, $userid);
$db->query("UPDATE `myplayers` SET `hp`=1,`cash`=`cash`-%%d%%,`hospital`=%%u%%,`hospreason`='Mugged by <a href=\'viewuser.php?u=".number_Format($userid)."\'>".strip_tags($ir['username'])."</a>, ' WHERE `userid`=%%u%%", $stole, $hosptime, $r['userid']);

If I'm correct, then that's just the way your $db->query function is written. I don't think this is actual mysql OR php syntax. If it were PHP, then it would be documented in the mysql_query function. If this were mysql, then you'd be able to execute this in say, phpmyadmin.

mysqli has some string formatting and variable binding functions, but I don't think you're using mysqli.

[Joshua]

^_^ MCCODES = failire = you ;]

I'm hurt, a child called me a failure.

 

Learn from other peoples codes? Why not? Everyday you learn from everyone else as well as php manual. It's called education, me thinks you should seek it out.

[Jordan Palmer]

@Zeggy; Very good point lol

[Zero-Affect]

The F stands for formatting, not filter ;)

There is a difference in what they do?

My bad format not filter but i prefer filter gives more insight into the action.

LazyT & Bug stop acting like kids seriously "my dads bigger than yours" don't make me hit you both with a php manual and send you to bed with no supper (calm down it's only a commercial).

[Joshua]

Could I learn more through Osmosis if you did?

^_-

[Zeggy]

Could I learn more through Osmosis if you did?

^_-

Being slapped by a php manual is not osmosis :D

[Joshua]

No but absorbing the knowledge inside would be, hence the question ^_^

[Zero-Affect]

I will gladly bounce a PHP manual off someone's head in a experiment :D

If they die ill just bury they like the last one 8o anyone up to helping me?

[mp]17[/mp]

[Joshua]

I'm kinda hard headed...if you hadnt noticed, we could always attempt.

if I learn through osmosis i'd be l33t php guru guy :O

[Guest cablebox]

Looks great! Great job for learning. Some bits that does not look right, but it is still good. Keep up the good work!

[Djkanna]

Well done OP :)

as for teh formatting remarks confused the toodles out of me :P

But if I think I'm right if you wrap in quotes and don't sprintf() by my logic it will input %%u% ImmortalThug :)

[(((TOLK)))]

Put a condom on your router :)

[Djkanna]

That would only protect you 99% of the time.. :P

[(((TOLK)))]

Then secure the rest by sanitising your scripts :P