Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: PHP mysql_excape but need to search for those items Date: Tue, 12 Jun 2012 11:35:11 +0200 Organization: A noiseless patient Spider Lines: 22 Message-ID: <4FD70D4F.2050104@arnowelzel.de> References: <3c8fad99-d356-4d8c-acfb-a1fe06503254@v9g2000vbc.googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Injection-Info: mx04.eternal-september.org; posting-host="l9c/A+zTZgD4vXu1XJ7hjg"; logging-data="30817"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19wbjJvEEWLUrhZsm0uBgoasTZwE2VJfbs=" User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 In-Reply-To: Cancel-Lock: sha1:Q6EwL3+xqLXB8sIFlNff/iHES3M= Xref: csiph.com comp.lang.php:6303 Jerry Stuckle, 11.06.2012 23:06: > On 6/11/2012 2:38 PM, J.O. Aho wrote: [...] >> Don't forget man in the middle, using https will not protect against >> that. > > Actually, it will. HTTPS transmissions are encrypted between the client > and the server using public/private key encryption. That's the whole > purpose of HTTPS. But only if the client *only* trusts the specific certificate. Otherwise the man in the middle can just set up a proxy which also accepts SSL connections and provides a valid certificate. There have been a number of broken CAs in the past which allowed virtually anyone to create signed and "trusted" certificates for any domain -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de