code-injection | 易学教程

Is this a safe way to filter data and prevent SQL-injection and other attacks?

阅读更多关于 Is this a safe way to filter data and prevent SQL-injection and other attacks?

I created two simple functions to filter inserted data before it's entered into a mysql query. For formfields (I am also using regular expressions to check each field individually. // Form filter function filter($var) { // HTML is not allowed $var = strip_tags(trim($var)); // Check magic quotes and stripslashes if(get_magic_quotes_gpc()) { $var = stripslashes($var); } // Not using it right now, is it recommended? // $var = htmlentities($var, ENT_QUOTES); // Escape $var = mysql_real_escape_string($var); // Return return $var; } Then for id's (sent in the URL) I am using this filter: // ID

How to Inject Controller for MVC4/VS2012/Web API

阅读更多关于 How to Inject Controller for MVC4/VS2012/Web API

I have read or tried to read far too many "how to"s on this and have gotten exactly nowhere. Unity? System.Web.Http.Dependencies? Ninject? StructureMap? Ugh. I just want something simple that works! I just can't figure out what the current state of this is. There are wildly different approaches and the examples appear to be incomplete. Heck the best lead had a sample project with it ... that I can't load in VS2010 or 2012. ARG! I waster 3/4 of the day on something that I feel should have been half an hour at most and move on! It's just plumbing! I have a repository that's based on generics to

SIMBL/Bundle/dylib injection into Dock.app

阅读更多关于 SIMBL/Bundle/dylib injection into Dock.app

I'm working on a simple SIMBL bundle to decrease the FullScreen animation time in Lion. It's no big deal to change the animation of the windows, however doing that for the menubar/desktop animation part (where the menubar+desktop slide to the left) is a problem. I think that Dock.app is responsible for that animation. However, SIMBL can't inject a bundle into Dock.app (same with Finder). I tried creating a .dylib which then would be loaded into Dock by setting the LSEnvironment in Dock's Info.plist but that failed. Is there any good way to inject a bundle/dylib into Dock.app? Thanks in Advance

Javascript script element set inner text

阅读更多关于 Javascript script element set inner text

问题 We need to add a javascript element inside an iframe (its inside the same web/domain so no security problems attached). We got it working but dont know how to fill the script content betwen its tags...how would you do it? var iframe = document.getElementById('iframeX'); var iframedocument = iframe.contentWindow.document; var script = iframedocument.createElement('script'); script.setAttribute('type', 'text/javascript'); script.innerText = 'alert(\'hello\')'; //this doesnt work script.value=

Sanitizing inputs to MongoDB

阅读更多关于 Sanitizing inputs to MongoDB

I'm writing a REST interface to a MongoDB database program, and I'm trying to implement search functionality. I'd like to expose the entire MongoDB interface. I have two questions, really, but they're related so I'm putting them in one post: Is it safe to decode untrusted JSON with the Python json module, or is it like the pickle module in that it could allow arbitrary code execution? Is it safe to pass that decoded JSON to the PyMongo find() function? Python's JSON module should be safe to use with untrusted input, at least in its default configuration (i.e. you haven't supplied any of the

How to use ptrace(2) to change behaviour of syscalls?

阅读更多关于 How to use ptrace(2) to change behaviour of syscalls?

问题 Are there any guides or examples (especially ARM ones) or libraries of using ptrace to affect execution of other process? For example, to make it believe that some data is appeared on file descriptor (i.e. release select/poll with some result and "answer" the following read syscall before the kernel). Expecting something involving PTRACE_SYSEMU. Can it be done in portable way? I want something like libc-overriding LD_PRELOAD trick, but which can be attached at runtime. Can it be done with

How to inject JavaScript into a website through the URL bar?

阅读更多关于 How to inject JavaScript into a website through the URL bar?

问题 Here is the JavaScript code I inject into the page: javascript:{document.head.innerHTML+='<script>function inject(){alert("hello");}</script>'; document.body.innerHTML+='<button onclick="inject()">Run</button>';} After running this code in the URL bar, I inspect the source code of the website. Both the button and the function definition are present, however pressing the button does not run the alert as one would expect. What could be the problem? 回答1: some browsers no longer accept javascript

Securing a Contact Form

阅读更多关于 Securing a Contact Form

问题 I have a client whose website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their subdomains. The asked my client to protect Contact Form 7 from malicious scripts or take it down. When I asked for an example of what they tested, my client informed me that they run tests to see if a script could be inserted into a input (ie: <script>alert('hello');</script> ) field or as a url

Spy++ for PowerBuilder applications

阅读更多关于 Spy++ for PowerBuilder applications

I'm trying to write a tool which lets me inspect the state of a PowerBuilder-based application. What I'm thinking of is something like Spy++ (or, even nicer, 'Snoop' as it exists for .NET applications) which lets me inspect the object tree (and properties of objects) of some PowerBuilder-based GUI. I did the same for ordinary (MFC-based) applications as well as .NET applications already, but unfortunately I never developed an application in PowerBuilder myself, so I'm generally thinking about two problems at this point: Is there some API (preferably in Java or C/C++) available which lets one

Angularjs: How to inject dependency from resolve routeProvider

阅读更多关于 Angularjs: How to inject dependency from resolve routeProvider

I have a problem injecting resolve parameters from the routing into the controller. I'm setting the resolve value to an object {name: 'Banner', slug: 'banner'} , but I get an error. App.js var app = angular.module('CMS', ['fields', 'ngRoute']); app.controller('ModuleController', ['$http', 'properties', function($http, properties) { var module = this; module.properties = properties; if (module.properties.slug.length) { $http.get(module.properties.slug + '.php').success(function(data) { module.list = data; }); } } ]); app.controller('HomeController', function() {}); app.config(function(