Comments on: Is Your PHP Web-form Hacker Proof? http://www.michikono.com/2007/05/14/is-your-php-web-form-hacker-proof/ Stuff only Michi cares to read Sun, 22 Jan 2012 10:48:00 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Rash http://www.michikono.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-5369 Rash Sun, 15 Jul 2007 23:12:59 +0000 http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-5369 yes it is. yes it is.

]]> By: thompson http://www.michikono.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-5136 thompson Wed, 11 Jul 2007 16:03:13 +0000 http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-5136 please i wanna learn how to hack credit cards i am thompson from usa new york 27 can u teach me or even send me some credi cards please i wanna learn how to hack credit cards i am thompson from usa new york 27 can u teach me or even send me some credi cards

]]> By: Information Security http://www.michikono.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-4878 Information Security Fri, 06 Jul 2007 02:00:08 +0000 http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-4878 Great article, it is good to see people learn from their mistakes and try an help others avoid problems. Keep up the good work. Great article, it is good to see people learn from their mistakes and try an help others avoid problems. Keep up the good work.

]]> By: Michi http://www.michikono.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-3303 Michi Wed, 30 May 2007 17:38:29 +0000 http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-3303 I am fairly certain my solution is correct. I am not looking for the text string "backslash n" and "backslash r", rather, I am looking for the converted equivalents. So if someone passed in those hex values, they would get converted into carriage returns and new lines before I look at them. In fact, never should I see the string text "0x0A" since at that point, it's already converted into the \r or \n. I am fairly certain my solution is correct. I am not looking for the text string “backslash n” and “backslash r”, rather, I am looking for the converted equivalents. So if someone passed in those hex values, they would get converted into carriage returns and new lines before I look at them. In fact, never should I see the string text “0x0A” since at that point, it’s already converted into the \r or \n.

]]> By: Mihai Roman http://www.michikono.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-3299 Mihai Roman Wed, 30 May 2007 14:17:15 +0000 http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-3299 Hello, I think this is not enough: "$fromAddress = str_replace(array("\r", "\n"), "", $formAddress);" Instead of "\n" or "\n" someone might try to use the hexadecimal equivalent for those characters. "\n" = 0x0A "\r" = 0x0D Still this isn't enough, but for further reading I would also recommend the link you already provided. Hello,

I think this is not enough:
“$fromAddress = str_replace(array(“\r”, “\n”), “”, $formAddress);”

Instead of “\n” or “\n” someone might try to use the hexadecimal equivalent for those characters.
“\n” = 0x0A
“\r” = 0x0D
Still this isn’t enough, but for further reading I would also recommend the link you already provided.

]]> By: ./blog » PHP mail() function security http://www.michikono.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-2825 ./blog » PHP mail() function security Mon, 21 May 2007 08:27:14 +0000 http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-2825 [...] Hmm, just a few days back i read this: http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/ [...] [...] Hmm, just a few days back i read this: http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/ [...]

]]> By: Ambush Commander http://www.michikono.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-2592 Ambush Commander Tue, 15 May 2007 20:44:24 +0000 http://www.michiknows.com/2007/05/14/is-your-php-web-form-hacker-proof/#comment-2592 The usual solution to mail() woes is to use a mailing library such as PHPMailer or, my personal favorite, SwiftMailer. The usual solution to mail() woes is to use a mailing library such as PHPMailer or, my personal favorite, SwiftMailer.

]]>