Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #11893 > unrolled thread

Check if $_GET contains something other than what's allowed

Back to article view | Back to comp.lang.php

Contents

  Check if $_GET contains something other than what's allowed Jason C <jwcarlton@gmail.com> - 2013-11-21 13:21 -0800
    Re: Check if $_GET contains something other than what's allowed Salvatore <sal@yojimbo.hack.invalid> - 2013-11-21 21:31 +0000
    Re: Check if $_GET contains something other than what's allowed Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-11-21 22:48 +0100
      Re: Check if $_GET contains something other than what's allowed Jerry Stuckle <jstucklex@attglobal.net> - 2013-11-21 17:16 -0500
        "Hackers" vs. "Crackers" (was: Re: Check if $_GET contains something other than what's allowed) Arno Welzel <usenet@arnowelzel.de> - 2013-11-22 17:36 +0100
          Re: "Hackers" vs. "Crackers" Jerry Stuckle <jstucklex@attglobal.net> - 2013-11-22 13:52 -0500
            Re: "Hackers" vs. "Crackers" j80k-vpfc@dea.spamcon.org (Steve) - 2013-11-30 11:49 +0000
              Re: "Hackers" vs. "Crackers" Jerry Stuckle <jstucklex@attglobal.net> - 2013-11-30 08:53 -0500
                Re: "Hackers" vs. "Crackers" j80k-vpfc@dea.spamcon.org (Steve) - 2013-11-30 14:58 +0000
                  Re: "Hackers" vs. "Crackers" Jerry Stuckle <jstucklex@attglobal.net> - 2013-11-30 10:15 -0500
                  Re: "Hackers" vs. "Crackers" The Natural Philosopher <tnp@invalid.invalid> - 2013-11-30 16:51 +0000
                  Re: "Hackers" vs. "Crackers" Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-12-01 17:13 +0100
              Re: "Hackers" vs. "Crackers" Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-11-30 15:30 +0100
                Re: "Hackers" vs. "Crackers" The Natural Philosopher <tnp@invalid.invalid> - 2013-11-30 16:33 +0000
                  Re: "Hackers" vs. "Crackers" Doug Miller <doug_at_milmac_dot_com@example.com> - 2013-11-30 17:13 +0000

#11893 — Check if $_GET contains something other than what's allowed

I have a script that's constantly under attack by hackers submitting odd queries. My script is tight enough that it's not been a problem, but still, it's annoying.

Just for the sake of peace of mind, how can I check for any $_GET key that's not allowed (in which case I can kill the script from the beginning)?

TIA,

Jason

[toc] | [next] | [standalone]

#11894

On 2013-11-21, Jason C <jwcarlton@gmail.com> wrote:
> Just for the sake of peace of mind, how can I check for any $_GET key
> that's not allowed (in which case I can kill the script from the
> beginning)?

$allowed_values = array('username', 'password', ...);

foreach ($_GET as $key => $value) {
    if (array_search($key, $allowed_values) === false) {
        // deny access here
    }
}

-- 
Blah blah bleh...
GCS/CM d(-)@>-- s+:- !a C++$ UBL++++$ L+$ W+++$ w M++ Y++ b++

[toc] | [prev] | [next] | [standalone]

#11895

Jason C wrote:

> I have a script that's constantly under attack by hackers submitting odd

s/hackers/crackers/

Rule of thumb: Hackers build, crackers (attempt to) destroy.

> queries. My script is tight enough that it's not been a problem, but
> still, it's annoying.
> 
> Just for the sake of peace of mind, how can I check for any $_GET key
> that's not allowed (in which case I can kill the script from the
> beginning)?

<http://php.net/isset>
<http://php.net/array_key_exists>

However, your problem more likely is having register_globals=on when it 
should be off; not validating user input, inviting SQL injection; aso.

<https://owasp.org/>


PointedEars
-- 
Prototype.js was written by people who don't know javascript for people
who don't know javascript. People who don't know javascript are not
the best source of advice on designing systems that use javascript.
  -- Richard Cornford, cljs, <f806at$ail$1$8300dec7@news.demon.co.uk>

[toc] | [prev] | [next] | [standalone]

#11898

On 11/21/2013 4:48 PM, Thomas 'PointedEars' Lahn wrote:
> Jason C wrote:
>
>> I have a script that's constantly under attack by hackers submitting odd
>
> s/hackers/crackers/
>
> Rule of thumb: Hackers build, crackers (attempt to) destroy.
>

No, hackers is the correct term. You really should learn to understand 
English before correcting a native speaker of it.

>> queries. My script is tight enough that it's not been a problem, but
>> still, it's annoying.
>>
>> Just for the sake of peace of mind, how can I check for any $_GET key
>> that's not allowed (in which case I can kill the script from the
>> beginning)?
>
> <http://php.net/isset>
> <http://php.net/array_key_exists>
>
> However, your problem more likely is having register_globals=on when it
> should be off; not validating user input, inviting SQL injection; aso.
>

There is no indication in his update that ANY of this is true.  In fact, 
his update seems to indicate exactly the opposite.

> <https://owasp.org/>
>
>
> PointedEars
>

Not everyone is as dense as you.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#11928 — "Hackers" vs. "Crackers" (was: Re: Check if $_GET contains something other than what's allowed)

Jerry Stuckle, 2013-11-21 23:16:

> On 11/21/2013 4:48 PM, Thomas 'PointedEars' Lahn wrote:
>> Jason C wrote:
>>
>>> I have a script that's constantly under attack by hackers submitting odd
>>
>> s/hackers/crackers/
>>
>> Rule of thumb: Hackers build, crackers (attempt to) destroy.
>>
> 
> No, hackers is the correct term. You really should learn to understand 
> English before correcting a native speaker of it.

<http://www.oxforddictionaries.com/definition/english/hacker?q=hacker>
<http://www.oxforddictionaries.com/definition/english/hacker?q=cracker>

Seems the official meaning of both words is the same.

And <http://en.wikipedia.org/wiki/Hacker> shows, there is much more
about this topic than a simple "hackers are people attacking computer
systems".

Anyway - "hacker" originally just referred to computer enthusiasts
"hacking" on their keyboards. Also see "Hackers: Heroes of the Computer
Revolution" by Steven Levy, ISBN 0-385-19195-2.

Some hackers *also* used their skills to gain access to systems with
poor or no special protection at all and some also sold the acquired
data - but this does not mean that a "hacker" is always a bad guy.

Later "hacking" also became the synonym for using technology in new ways
- a "hack" is just another creative use for existing technology or to
deal with technical limitations.

On the opposite - "cracking" originally referred to "crack" copy
protections in computer games. In the 1980ies there where a number of
popular "Cracker Groups", for example:

<http://csdb.dk/search/advancedresult.php?form[category]=groups&group_type[]=2>

Later "cracker" was also used as a synonym for "bad" hackers with
criminal intents. But today many people just say "hacker" when they
actually mean "black hat" or "script kiddie".


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#11930 — Re: "Hackers" vs. "Crackers"

On 11/22/2013 11:36 AM, Arno Welzel wrote:
> Jerry Stuckle, 2013-11-21 23:16:
>
>> On 11/21/2013 4:48 PM, Thomas 'PointedEars' Lahn wrote:
>>> Jason C wrote:
>>>
>>>> I have a script that's constantly under attack by hackers submitting odd
>>>
>>> s/hackers/crackers/
>>>
>>> Rule of thumb: Hackers build, crackers (attempt to) destroy.
>>>
>>
>> No, hackers is the correct term. You really should learn to understand
>> English before correcting a native speaker of it.
>
> <http://www.oxforddictionaries.com/definition/english/hacker?q=hacker>
> <http://www.oxforddictionaries.com/definition/english/hacker?q=cracker>
>
> Seems the official meaning of both words is the same.
>

Which means Pointed Head's correction was WRONG.  And "Hackers" is much 
more recognized and used than "crackers".  But once again, a non-native 
English speaker is trying to correct a native English speaker.

> And <http://en.wikipedia.org/wiki/Hacker> shows, there is much more
> about this topic than a simple "hackers are people attacking computer
> systems".
>
> Anyway - "hacker" originally just referred to computer enthusiasts
> "hacking" on their keyboards. Also see "Hackers: Heroes of the Computer
> Revolution" by Steven Levy, ISBN 0-385-19195-2.
>

Yes, and "Hello" was originally an exclamation of surprise.  Word 
definitions change.

> Some hackers *also* used their skills to gain access to systems with
> poor or no special protection at all and some also sold the acquired
> data - but this does not mean that a "hacker" is always a bad guy.
>

I never said it did.

> Later "hacking" also became the synonym for using technology in new ways
> - a "hack" is just another creative use for existing technology or to
> deal with technical limitations.
>

That term was popular long before computers came into popularity.

> On the opposite - "cracking" originally referred to "crack" copy
> protections in computer games. In the 1980ies there where a number of
> popular "Cracker Groups", for example:
>
> <http://csdb.dk/search/advancedresult.php?form[category]=groups&group_type[]=2>
>
> Later "cracker" was also used as a synonym for "bad" hackers with
> criminal intents. But today many people just say "hacker" when they
> actually mean "black hat" or "script kiddie".
>
>

"Black Hat" and "Script Kiddie" have different meanings, and are a 
subset of hackers.  "Black Hat" originally referred to spies.  And 
"script kiddies" may or may not be bad guys.  Richard, for instance.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#12034 — Re: "Hackers" vs. "Crackers"

In article <l6o95r$te7$1@dont-email.me>, jstucklex@attglobal.net (Jerry
Stuckle) wrote:

> *Subject:* Re: "Hackers" vs. "Crackers"
> *From:* Jerry Stuckle <jstucklex@attglobal.net>
> *Date:* Fri, 22 Nov 2013 13:52:38 -0500
> 
Hardware hackers are the opposite of software hackers.

http://hackaday.com

[toc] | [prev] | [next] | [standalone]

#12036 — Re: "Hackers" vs. "Crackers"

On 11/30/2013 6:49 AM, Steve wrote:
> In article <l6o95r$te7$1@dont-email.me>, jstucklex@attglobal.net (Jerry
> Stuckle) wrote:
>
>> *Subject:* Re: "Hackers" vs. "Crackers"
>> *From:* Jerry Stuckle <jstucklex@attglobal.net>
>> *Date:* Fri, 22 Nov 2013 13:52:38 -0500
>>
> Hardware hackers are the opposite of software hackers.
>
> http://hackaday.com
>

Who's talking about hardware hackers?

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#12040 — Re: "Hackers" vs. "Crackers"

In article <l7cql2$ueg$1@dont-email.me>, jstucklex@attglobal.net (Jerry
Stuckle) wrote:

> *Subject:* Re: "Hackers" vs. "Crackers"
> *From:* Jerry Stuckle <jstucklex@attglobal.net>
> *Date:* Sat, 30 Nov 2013 08:53:37 -0500
> 
> On 11/30/2013 6:49 AM, Steve wrote:
> > In article <l6o95r$te7$1@dont-email.me>, jstucklex@attglobal.net 
> > (Jerry
> > Stuckle) wrote:
> >
> >> *Subject:* Re: "Hackers" vs. "Crackers"
> >> *From:* Jerry Stuckle <jstucklex@attglobal.net>
> >> *Date:* Fri, 22 Nov 2013 13:52:38 -0500
> >>
> > Hardware hackers are the opposite of software hackers.
> >
> > http://hackaday.com
> >
> 
> Who's talking about hardware hackers?
> 
> -- 
> ==================
> Remove the "x" from my email address
> Jerry Stuckle
> JDS Computer Training Corp.
> jstucklex@attglobal.net
> ==================
> 
Somebody further up the thread suggested that hackers build.

I was just pointing out that hardware hackers do, software hackers don't.

[toc] | [prev] | [next] | [standalone]

#12041 — Re: "Hackers" vs. "Crackers"

On 11/30/2013 9:58 AM, Steve wrote:
> In article <l7cql2$ueg$1@dont-email.me>, jstucklex@attglobal.net (Jerry
> Stuckle) wrote:
>
>> *Subject:* Re: "Hackers" vs. "Crackers"
>> *From:* Jerry Stuckle <jstucklex@attglobal.net>
>> *Date:* Sat, 30 Nov 2013 08:53:37 -0500
>>
>> On 11/30/2013 6:49 AM, Steve wrote:
>>> In article <l6o95r$te7$1@dont-email.me>, jstucklex@attglobal.net
>>> (Jerry
>>> Stuckle) wrote:
>>>
>>>> *Subject:* Re: "Hackers" vs. "Crackers"
>>>> *From:* Jerry Stuckle <jstucklex@attglobal.net>
>>>> *Date:* Fri, 22 Nov 2013 13:52:38 -0500
>>>>
>>> Hardware hackers are the opposite of software hackers.
>>>
>>> http://hackaday.com
>>>
>>
>> Who's talking about hardware hackers?
>>
>>
> Somebody further up the thread suggested that hackers build.
>
> I was just pointing out that hardware hackers do, software hackers don't.
>

Which has nothing to do with the discussion at hand.  And software 
hackers can build, also.  Not all are bad guys.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#12045 — Re: "Hackers" vs. "Crackers"

On 30/11/13 14:58, Steve wrote:
> In article <l7cql2$ueg$1@dont-email.me>, jstucklex@attglobal.net (Jerry
> Stuckle) wrote:
>
>> *Subject:* Re: "Hackers" vs. "Crackers"
>> *From:* Jerry Stuckle <jstucklex@attglobal.net>
>> *Date:* Sat, 30 Nov 2013 08:53:37 -0500
>>
>> On 11/30/2013 6:49 AM, Steve wrote:
>>> In article <l6o95r$te7$1@dont-email.me>, jstucklex@attglobal.net
>>> (Jerry
>>> Stuckle) wrote:
>>>
>>>> *Subject:* Re: "Hackers" vs. "Crackers"
>>>> *From:* Jerry Stuckle <jstucklex@attglobal.net>
>>>> *Date:* Fri, 22 Nov 2013 13:52:38 -0500
>>>>
>>> Hardware hackers are the opposite of software hackers.
>>>
>>> http://hackaday.com
>>>
>>
>> Who's talking about hardware hackers?
>>
>> --
>> ==================
>> Remove the "x" from my email address
>> Jerry Stuckle
>> JDS Computer Training Corp.
>> jstucklex@attglobal.net
>> ==================
>>
> Somebody further up the thread suggested that hackers build.
>
> I was just pointing out that hardware hackers do, software hackers don't.
>
and even then you were wrong.

hacking is or was simply 'building without a formal specification'  that 
is you knocked something up and 'hacked' at it until it resembled what 
you were trying to achieve. A bit like sculpting.

Iterative design is the technical term :-)

Any decent software or hardware person has done it. It pays when the 
overhead of dong the design exceeds the time taken to hack away and get 
somewhere. Most successful designs are a mixture of both.

Keith Duckworth on the Cosworth V8 engine development "we just hacked 
off metal from the crankcase to reduce weight till it broke, then we'd 
put that bit back and try somewhere else"

Software hacking is no different. Think of a part of the problem, you 
know how to solve. Write that. Then decide what else you need. What you 
have already written defines the interface to that, and means your 
problem is already bounded. Hack code until what you have fits with the 
first hack, and solves another bit. Repeat till it all works, then give 
it to test and see where it breaks, then add bits back till it doesn't. 
Then sell and wait for the bug reports. Anywone who thinks Microsoft 
Windows wasn't written that way has never disassembled it.

Exactly the same is true of a Porsche sports car. Take a lousy swing 
axled cheap nightmare of a car - a volkswagen beetle - and tune it up 
till it breaks and keep adding bits over a period of 30 years till it 
really actually does go quite fast and not break that often. Yes,  its 
still a tricky evil tail happy bitch of a car to drive so give your 
customers lessons in how to handle, hack in some traction control and a 
lot of electronics and pretend its more advanced that a car that doesn't 
need all that to be safe to drive...


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#12049 — Re: "Hackers" vs. "Crackers"

Steve wrote:

> Somebody further up the thread suggested that hackers build.

It was me, and I was specifically referring to software hackers.
 
> I was just pointing out that hardware hackers do, software hackers don't.

Nonsense, cf. <http://www.catb.org/esr/faqs/hacker-howto.html> etc.


PointedEars
-- 
When all you know is jQuery, every problem looks $(olvable).

[toc] | [prev] | [next] | [standalone]

#12038 — Re: "Hackers" vs. "Crackers"

Steve wrote:

> Hardware hackers are the opposite of software hackers.

Nonsense.
 

PointedEars
-- 
Sometimes, what you learn is wrong. If those wrong ideas are close to the 
root of the knowledge tree you build on a particular subject, pruning the 
bad branches can sometimes cause the whole tree to collapse.
  -- Mike Duffy in cljs, <news:Xns9FB6521286DB8invalidcom@94.75.214.39>

[toc] | [prev] | [next] | [standalone]

#12042 — Re: "Hackers" vs. "Crackers"

On 30/11/13 14:30, Thomas 'PointedEars' Lahn wrote:
> Steve wrote:
>
>> Hardware hackers are the opposite of software hackers.
>
> Nonsense.
>
bent noses are the opposite of pointed ears.

>
> PointedEars
>


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#12046 — Re: "Hackers" vs. "Crackers"

The Natural Philosopher <tnp@invalid.invalid> wrote in news:l7d40j$rds$2
@news.albasani.net:

> On 30/11/13 14:30, Thomas 'PointedEars' Lahn wrote:
>> Steve wrote:
>>
>>> Hardware hackers are the opposite of software hackers.
>>
>> Nonsense.
>>
> bent noses are the opposite of pointed ears.

Dollars to doughnuts he doesn't get the reference. (English is not PointedHead's first 
language, and he doesn't understand it nearly as well as he thinks he does.)

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web