Extended Basic 7

[comperr]

As some of you may have noticed extbasic 7 has changed a few times.
Here is the final version of the CODE:

Code: Select all

<pre>
<?php
if (!empty($_POST['data']))
{
   $data = mysql_real_escape_string($_POST['data']);
   mysql_query("INSERT INTO tbl_data (data) VALUES '$data'");
}

?>
<form name="grezvahfvfnjuvavatovgpu" action="<?=$_SERVER['PHP_SELF']?>" method="get">
   <input type="textbox" name="data" />
   <input type="submit" />
</form>
</pre>


[TheMindRapist]

Hmm, I think that's how it was when I did it.

[Nyteblade]

Nice... I was beginning to think I was going nuts LOL
(is it GET?... I thought it was POST... wait, or was it GET? Maybe it was... was it? I don't know now. My head hurts. "Our precious. We's must take the precious from those stupid hobbitses") LMAO

[satanswrath]

Isnt it method="post"> instead of ="get">?
I tried changing it but its still not right.. Tried XSS but didnt work.
Any hints?

[nermd]

i realy dont get this, i mean i tried every function i know suitable to prevent the xss with ; and without ; at the end, i even tried different style of coding (blanks between the tags and php code or between functionname and () ...), i also tried every combination with method="post" and method="get".
Please, change your validation code, thats just boring ...

[I-MrKnox-I]

/agree nermd

[comperr]

Look for a BUG and a VULN. There are TWO problems!

[Mindzai]

Look for a BUG and a VULN. There are TWO problems!

Part of the problem I think is that the vuln can be fixed in a variety of ways (using $_SERVER['SCRIPT_FILENAME'], #, basename(__FILE__) to name but 3). The bug is easy enough to fix but valid fixes for the XSS vuln are not accepted.

[pitagora]

edit:spoiler

[sharpskater69]

Posible spoiler:

There are many ways to sanitize [Removed] (assuming you all know this is the vuln) as you might know by now. However, most of the ways will sanitize a lot of "innocent" chars too. We do not want this to happen. Luckily there is an alternative which is very alike, but only sanitizes the most "dangerous" chars like '<', '>' and quotes. This is what we are looking for.

That should give an idea, now look up string functions.