Search Results

Search found 33012 results on 1321 pages for 'method injection'.

Page 10/1321 | < Previous Page | 6 7 8 9 10 11 12 13 14 15 16 17  | Next Page >

  • Steps after SQL Injection detected

    - by Zukas
    I've come across SQL injection vulnerabilities on my companies ecommerce page. It was fairly poorly put together. I believe I have prevented future attempts however we are getting calls about fraudulent credit card charges on our site and others. This leads me to believe that someone was able to get a list of our credit card numbers. What doesn't make sense is that we don't store that information and we use Authorize.net for the transaction. If someone was able to get the CC#s, what should I do next? Inform ALL of our customers that someone broken into our system and stole their information? I have a feeling that will be bad for business.

    Read the article

  • HTG Explains: How Hackers Take Over Web Sites with SQL Injection / DDoS

    - by Jason Faulkner
    Even if you’ve only loosely followed the events of the hacker groups Anonymous and LulzSec, you’ve probably heard about web sites and services being hacked, like the infamous Sony hacks. Have you ever wondered how they do it? There are a number of tools and techniques that these groups use, and while we’re not trying to give you a manual to do this yourself, it’s useful to understand what’s going on. Two of the attacks you consistently hear about them using are “(Distributed) Denial of Service” (DDoS) and “SQL Injections” (SQLI). Here’s how they work. Image by xkcd HTG Explains: How Hackers Take Over Web Sites with SQL Injection / DDoS Use Your Android Phone to Comparison Shop: 4 Scanner Apps Reviewed How to Run Android Apps on Your Desktop the Easy Way

    Read the article

  • SQL Injection: How it Works and How to Thwart it

    This is an extract from the book Tribal SQL. In this article, Kevin Feasel explains SQL injection attacks, how to defend against them, and how to keep your Chief Information Security Officer from appearing on the nightly news. NEW! The DBA Team in The Girl with the Backup TattooPina colada in the disk drives! How could any DBA do such a thing? And can the DBA Team undo the damage? Find out in Part 2 of their new series, 5 Worst Days in a DBA’s Life. Read the new article now.

    Read the article

  • What is the difference between Inversion of Control and Dependency injection in C++?

    - by rlbond
    I've been reading recently about DI and IoC in C++. I am a little confused (even after reading related questions here on SO) and was hoping for some clarification. It seems to me that being familiar with the STL and Boost leads to use of dependency injection quite a bit. For example, let's say I made a function that found the mean of a range of numbers: template <typename Iter> double mean(Iter first, Iter last) { double sum = 0; size_t number = 0; while (first != last) { sum += *(first++); ++number; } return sum/number; }; Is this dependency injection? Inversion of control? Neither? Let's look at another example. We have a class: class Dice { public: typedef boost::mt19937 Engine; Dice(int num_dice, Engine& rng) : n_(num_dice), eng_(rng) {} int roll() { int sum = 0; for (int i = 0; i < num_dice; ++i) sum += boost::uniform_int<>(1,6)(eng_); return sum; } private: Engine& eng_; int n_; }; This seems like dependency injection. But is it inversion of control? Also, if I'm missing something, can someone help me out?

    Read the article

  • C++, inject additional data in a method

    - by justik
    I am adding the new modul in some large library. All methods here are implemented as static. Let mi briefly describe the simplified model: typedef std::vector<double> TData; double test ( const TData &arg ) { return arg ( 0 ) * sin ( arg ( 1 ) + ...;} double ( * p_test ) ( const TData> &arg) = &test; class A { public: static T f1 (TData &input) { .... //some computations B::f2 (p_test); } }; Inside f1() some computations are perfomed and a static method B::f2 is called. The f2 method is implemented by another author and represents some simulation algorithm (example here is siplified). class B { public: static double f2 (double ( * p_test ) ( const TData &arg ) ) { //difficult algorithm working p_test many times double res = p_test(arg); } }; The f2 method has a pointer to some weight function (here p_test). But in my case some additional parameters computed in f1 for test() methods are required double test ( const TData &arg, const TData &arg2, char *arg3.... ) { } How to inject these parameters into test() (and so to f2) to avoid changing the source code of the f2 methods (that is not trivial), redesign of the library and without dirty hacks :-) ? The most simple step is to override f2 static double f2 (double ( * p_test ) ( const TData &arg ), const TData &arg2, char *arg3.... ) But what to do later? Consider, that methods are static, so there will be problems with objects. Thanks for your help.

    Read the article

  • Go - Concurrent method

    - by nevalu
    How to get a concurrent method? In my case, the library would be called from a program to get a value to each argument str --in method Get()--. When it's used Get() then it assigns a variable from type bytes.Buffer which it will have the value to return. The returned values --when it been concurrently called-- will be stored into a database or a file and it doesn't matter that its output been of FIFO way (from method). type test struct { foo uint8 bar uint8 } func NewTest(arg1 string) (*test, os.Error) {...} func (self *test) Get(str string) ([]byte, os.Error) { var format bytes.Buffer ... } I think that all code inner of method Get() should be put inner of go func() {...}(), and then to use a channel. Would there be a problem if it's called another method from Get()? Or would it also has to be concurrent?

    Read the article

  • Dependency injection: what belongs in the constructor?

    - by Adam Backstrom
    I'm evaluating my current PHP practices in an effort to write more testable code. Generally speaking, I'm fishing for opinions on what types of actions belong in the constructor. Should I limit things to dependency injection? If I do have some data to populate, should that happen via a factory rather than as constructor arguments? (Here, I'm thinking about my User class that takes a user ID and populates user data from the database during construction, which obviously needs to change in some way.) I've heard it said that "initialization" methods are bad, but I'm sure that depends on what exactly is being done during initialization. At the risk of getting too specific, I'll also piggyback a more detailed example onto my question. For a previous project, I built a FormField class (which handled field value setting, validation, and output as HTML) and a Model class to contain these fields and do a bit of magic to ease working with fields. FormField had some prebuilt subclasses, e.g. FormText (<input type="text">) and FormSelect (<select>). Model would be subclassed so that a specific implementation (say, a Widget) had its own fields, such as a name and date of manufacture: class Widget extends Model { public function __construct( $data = null ) { $this->name = new FormField('length=20&label=Name:'); $this->manufactured = new FormDate; parent::__construct( $data ); // set above fields using incoming array } } Now, this does violate some rules that I have read, such as "avoid new in the constructor," but to my eyes this does not seem untestable. These are properties of the object, not some black box data generator reading from an external source. Unit tests would progressively build up to any test of Widget-specific functionality, so I could be confident that the underlying FormFields were working correctly during the Widget test. In theory I could provide the Model with a FieldFactory() which could supply custom field objects, but I don't believe I would gain anything from this approach. Is this a poor assumption?

    Read the article

  • Balancing dependency injection with public API design

    - by kolektiv
    I've been contemplating how to balance testable design using dependency injection with providing simple fixed public API. My dilemma is: people would want to do something like var server = new Server(){ ... } and not have to worry about creating the many dependencies and graph of dependencies that a Server(,,,,,,) may have. While developing, I don't worry too much, as I use an IoC/DI framework to handle all that (I'm not using the lifecycle management aspects of any container, which would complicate things further). Now, the dependencies are unlikely to be re-implemented. Componentisation in this case is almost purely for testability (and decent design!) rather than creating seams for extension, etc. People will 99.999% of the time wish to use a default configuration. So. I could hardcode the dependencies. Don't want to do that, we lose our testing! I could provide a default constructor with hard-coded dependencies and one which takes dependencies. That's... messy, and likely to be confusing, but viable. I could make the dependency receiving constructor internal and make my unit tests a friend assembly (assuming C#), which tidies the public API but leaves a nasty hidden trap lurking for maintenance. Having two constructors which are implicitly connected rather than explicitly would be bad design in general in my book. At the moment that's about the least evil I can think of. Opinions? Wisdom?

    Read the article

  • [PHP] Weird problem with dynamic method invocation

    - by Rolf
    Hi everyone, this time, I'm facing a really weird problem. I've the following code: $xml = simplexml_load_file($this->interception_file); foreach($xml->children() as $class) { $path = str_replace('__CLASS_DIR__',CLASS_DIR,$class['path']); if(!is_file($path)) { throw new Exception('Bad configuration: file '.$path.' not found'); } $className = pathinfo($path,PATHINFO_FILENAME); foreach($class as $method) { $method_name = $method['name']; $obj = new $className(); var_dump(in_array($method_name,get_class_methods($className)));exit; echo $obj->$method_name();### not a method ??? } } As you can see, I get the class name and method name from an XML file. I can create an instance of the class without any problem. The var_dump at the end returns true, that means $method_name (which has 2 optional parameters) is a method of $className. BUT, and I am pretty sure the syntax is correct, when I try: $obj-$method_name() I get: Fatal error: Method name must be a string If you have any ideas, pleaaaaase tell me :) Thanks in advance, Rolf

    Read the article

  • When using method chaining, do I reuse the object or create one?

    - by MainMa
    When using method chaining like: var car = new Car().OfBrand(Brand.Ford).OfModel(12345).PaintedIn(Color.Silver).Create(); there may be two approaches: Reuse the same object, like this: public Car PaintedIn(Color color) { this.Color = color; return this; } Create a new object of type Car at every step, like this: public Car PaintedIn(Color color) { var car = new Car(this); // Clone the current object. car.Color = color; // Assign the values to the clone, not the original object. return car; } Is the first one wrong or it's rather a personal choice of the developer? I believe that he first approach may quickly cause the intuitive/misleading code. Example: // Create a car with neither color, nor model. var mercedes = new Car().OfBrand(Brand.MercedesBenz).PaintedIn(NeutralColor); // Create several cars based on the neutral car. var yellowCar = mercedes.PaintedIn(Color.Yellow).Create(); var specificModel = mercedes.OfModel(99).Create(); // Would `specificModel` car be yellow or of neutral color? How would you guess that if // `yellowCar` were in a separate method called somewhere else in code? Any thoughts?

    Read the article

  • Are the ASP.net __EVENTTARGET and __EVENTARGUMENT susceptible to SQL injection?

    - by Schleichermann
    A security review was done against one of our ASP.net applications and returned in the test results was a SQL Injection Exposures considered to be a high risk item. The test that was performed passed a SQL statement as the value of the __EVENTTARGET and the __EVENTARGUMENT. I am wondering since these 2 values are ASP.net auto-generated hidden fields used for the Auto-Postback feature of the framework and hold information specific to the controls initiating the postback, is there really the potential for SQL injection if you are never manually calling and or pulling values out of these parameters in your code behind?

    Read the article

  • Are there any differences between SQL Server and MySQL when it comes to preventing SQL injection?

    - by Derek Adair
    I am used to developing in PHP/MySQL and have no experience developing with SQL Server. I've skimmed over the PHP MSSQL documentation and it looks similar to MySQLi in some of the methods I read about. For example, with MySQL I utilize the function mysql_real_excape_string(). Is there a similar function with PHP/SQL Server? What steps do I need to take in order to protect against SQL injection with SQL Server? What are the differences between SQL Server and MySQL pertaining to SQL injection prevention? also - is this post accurate? is the escape string character for SQL Server a single quote?

    Read the article

  • Are there any differences between MSSQL and MySQL when it comes to preventing SQL injection?

    - by Derek Adair
    I am used to developing in PHP/MySQL and have no experience developing with MSSQL. I've skimmed over the PHP MSSQL documentation and it looks similar to MySQLi in some of the methods I read about. For example, with MySQL I utilize the function mysql_real_excape_string(). Is there a similar function with PHP/MSSQL? What steps do I need to take in order to protect against SQL injection with MSSQL? What are the differences between MSSQL and MySQL pertaining to SQL injection prevention?

    Read the article

  • Is there any injection vunerability in the body of an email?

    - by Brett
    Hey guys..... AFAIK there is only a vulnerability within the HEADERS of an email when using user data correct? I am using the below function to sanitize my data, however I have some textarea fields on the page & hence these may contain linebreaks.. so was wondering if that user data is only going to be put in the body of the email, can it not bother with being sanitized - apart from stripping html of course? Here is the function: function is_injected($str) { $injections = array('(\n+)', '(\r+)', '(\t+)', '(%0A+)', '(%0D+)', '(%08+)', '(%09+)' ); $inject = join('|', $injections); $inject = "/$inject/i"; if (preg_match($inject,$str)) { return true; } else { return false; } } As a side note, surprised there wasn't currently a tag for mail-injection / email-injection. Thanks!

    Read the article

  • in python: can i pass class method as and a default argument to another class method

    - by alex
    i want to to pass class method as and a default argument to another class method, so that i can re-use the method as a @classmethod @classmethod class foo: def func1(self,x): do somthing; def func2(self, aFunc = self.func1): # make some a call to afunc afunc(4) this why when the method func2 is called within the class aFunc defaults to self.func1, but i can call this same function from outside of the class and pass it a different function at the input. i get NameError: name 'self' is not defined

    Read the article

  • How to name a static factory method in the utility class?

    - by leventov
    I have an interface MyLongNameInterface with a counterpart utility class MyLongNameInterfaces. What is the best name for a static factory method in the utility class, which creates an instance of MyLongNameInterface? MyLongNameInterfaces.newInstance() -- a new instance of the utility class? MyLongNameInterfaces.newMyLongNameInterface() -- too verbose MyLongNameInterfaces.create() -- create an instance of the utility class? Also, create is not a widely used conventional verb in Java better option?

    Read the article

  • Dependency Injection Introduction

    - by MarkPearl
    I recently was going over a great book called “Dependency Injection in .Net” by Mark Seeman. So far I have really enjoyed the book and would recommend anyone looking to get into DI to give it a read. Today I thought I would blog about the first example Mark gives in his book to illustrate some of the benefits that DI provides. The ones he lists are Late binding Extensibility Parallel Development Maintainability Testability To illustrate some of these benefits he gives a HelloWorld example using DI that illustrates some of the basic principles. It goes something like this… class Program { static void Main(string[] args) { var writer = new ConsoleMessageWriter(); var salutation = new Salutation(writer); salutation.Exclaim(); Console.ReadLine(); } } public interface IMessageWriter { void Write(string message); } public class ConsoleMessageWriter : IMessageWriter { public void Write(string message) { Console.WriteLine(message); } } public class Salutation { private readonly IMessageWriter _writer; public Salutation(IMessageWriter writer) { _writer = writer; } public void Exclaim() { _writer.Write("Hello World"); } }   If you had asked me a few years ago if I had thought this was a good approach to solving the HelloWorld problem I would have resounded “No”. How could the above be better than the following…. class Program { static void Main(string[] args) { Console.WriteLine("Hello World"); Console.ReadLine(); } }  Today, my mind-set has changed because of the pain of past programs. So often we can look at a small snippet of code and make judgements when we need to keep in mind that we will most probably be implementing these patterns in projects with hundreds of thousands of lines of code and in projects that we have tests that we don’t want to break and that’s where the first solution outshines the latter. Let’s see if the first example achieves some of the outcomes that were listed as benefits of DI. Could I test the first solution easily? Yes… We could write something like the following using NUnit and RhinoMocks… [TestFixture] public class SalutationTests { [Test] public void ExclaimWillWriteCorrectMessageToMessageWriter() { var writerMock = MockRepository.GenerateMock<IMessageWriter>(); var sut = new Salutation(writerMock); sut.Exclaim(); writerMock.AssertWasCalled(x => x.Write("Hello World")); } }   This would test the existing code fine. Let’s say we then wanted to extend the original solution so that we had a secure message writer. We could write a class like the following… public class SecureMessageWriter : IMessageWriter { private readonly IMessageWriter _writer; private readonly string _secretPassword; public SecureMessageWriter(IMessageWriter writer, string secretPassword) { _writer = writer; _secretPassword = secretPassword; } public void Write(string message) { if (_secretPassword == "Mark") { _writer.Write(message); } else { _writer.Write("Unauthenticated"); } } }   And then extend our implementation of the program as follows… class Program { static void Main(string[] args) { var writer = new SecureMessageWriter(new ConsoleMessageWriter(), "Mark"); var salutation = new Salutation(writer); salutation.Exclaim(); Console.ReadLine(); } }   Our application has now been successfully extended and yet we did very little code change. In addition, our existing tests did not break and we would just need add tests for the extended functionality. Would this approach allow parallel development? Well, I am in two camps on parallel development but with some planning ahead of time it would allow for it as you would simply need to decide on the interface signature and could then have teams develop different sections programming to that interface. So,this was really just a quick intro to some of the basic concepts of DI that Mark introduces very successfully in his book. I am hoping to blog about this further as I continue through the book to list some of the more complex implementations of containers.

    Read the article

  • call a class method from inside an instance method from a module mixin (rails)

    - by sean
    Curious how one would go about calling a class method from inside an instance method of a module which is included by an active record class. For example I want both user and client models to share the nuts and bolts of password encryption. # app/models class User < ActiveRecord::Base include Encrypt end class Client < ActiveRecord::Base include Encrypt end # app/models/shared/encrypt.rb module Encrypt def authenticate # I want to call the ClassMethods#encrypt_password method when @user.authenticate is run self.password_crypted == self.encrypt_password(self.password) end def self.included(base) base.extend ClassMethods end module ClassMethods def encrypt_password(password) Digest::SHA1.hexdigest(password) end end end However, this fails. Says that the class method cannot be found when the instance method calls it. I can call User.encrypt_password('password') but User.new.encrypt_password fails Any thoughts?

    Read the article

  • Java Finalize method call

    - by Rajesh Kumar J
    I need to find when finalized method called in the JVM. I Created a test Class which write into file when finalized method called by Overriding the protected finalize method It is not executing. Can anybody tell me the reason why it is not executing?? Thanks in Advance

    Read the article

  • Confused about this factory, as it doesn't look like an Abstract Factory nor Factory Method

    - by Pin
    I'm looking into Guice and I've been reading its documentation recently. Reading the motivation section I don't understand the factories part, why they name it that way. To me that factory is just a wrapper for the implementing class they want it to return after calling getInstance(). public class CreditCardProcessorFactory { private static CreditCardProcessor instance; public static void setInstance(CreditCardProcessor creditCardProcessor) { instance = creditCardProcessor; } public static CreditCardProcessor getInstance() { if (instance == null) { throw new IllegalStateException("CreditCardProcessorFactory not initialized. " + "Did you forget to call CreditCardProcessor.setInstance() ?"); } return instance; } } Why do they call it factory as well if it is neither an abstract factory nor a factory method? Or am I missing something? Thanks.

    Read the article

  • ASP.NET lock thread method

    - by Peter
    Hello, I'm developing an ASP.NET forms webapplication using C#. I have a method which creates a new Order for a customer. It looks similar to this; private string CreateOrder(string userName) { // Fetch current order Order order = FetchOrder(userName); if (order.OrderId == 0) { // Has no order yet, create a new one order.OrderNumber = Utility.GenerateOrderNumber(); order.Save(); } return order; } The problem here is, it is possible that 1 customer in two requests (threads) could cause this method to be called twice while another thread is also inside this method. This can cause two orders to be created. How can I properly lock this method, so it can only be executed by one thread at a time per customer? I tried; Mutex mutex = null; private string CreateOrder(string userName) { if (mutex == null) { mutex = new Mutex(true, userName); } mutex.WaitOne(); // Code from above mutex.ReleaseMutex(); mutex = null; return order; } This works, but on some occasions it hangs on WaitOne and I don't know why. Is there an error, or should I use another method to lock? Thanks

    Read the article

  • custom compare method in objective c

    - by Jonathan
    I'm trying to use a custom compare method (for use with sortedArrayusingSelector) and on another website I got that the format is: -(NSComparisonResult) orderByName:(id)otherobject { That's all bery well and good except how do I compare the otherObject to anything as there's only one thing passed to the method? Like how does the NSString method of compare: compare 2 strings when only one string is passed?

    Read the article

  • groovy call private method in Java super class

    - by Jeff Storey
    I have an abstract Java class MyAbstractClass with a private method. There is a concrete implementation MyConcreteClass. public class MyAbstractClass { private void somePrivateMethod(); } public class MyConcreteClass extends MyAbstractClass { // implementation details } In my groovy test class I have class MyAbstractClassTest { void myTestMethod() { MyAbstractClass mac = new MyConcreteClass() mac.somePrivateMethod() } } I get an error that there is no such method signature for somePrivateMethod. I know groovy can call private methods but I'm guessing the problem is that the private method is in the super class, not MyConcreteClass. Is there a way to invoke a private method in the super class like this (other than using something like PrivateAccessor)? thanks Jeff

    Read the article

  • Invoke private method with interface as argument

    - by Stephanie
    Hi, I've been attempting to invoke a private method whose argument is a parameter and I can't quite seem to get it right. Here's kind of how the code looks so far: public class TestClass { public TestClass(){ } private void simpleMethod( Map<String, Integer> testMap) { //code logic } } Then I attempt to use this to invoke the private method: //Hashmap Map <String, Integer> testMap = new HashMap <String, Integer>(); //method I want to invoke Method simpleMethod = TestClass.class.getDeclaredMethod("simpleMethod", Map.class); simpleMethod.setAccessible(true); simpleMethod.invoke(testClassObject, testMap); //Throws an IllegalArgumentException As you can see, it throws an IllegalArgumentException. I've attempted to cast the hashmap back to a map, but that didn't work. What am I doing wrong?

    Read the article

  • LINQ method chaining and granular error handling

    - by Clafou
    I have a method which can be written pretty neatly through method chaining: return viewer.ServerReport.GetParameters() .Single(p => p.Name == Convention.Ssrs.RegionParamName) .ValidValues .Select(v => v.Value); However I'd like to be able to do some checks at each point as I wish to provide helpful diagnostics information if any of the chained methods returns unexpected results. To achieve this, I need to break up all my chaining and follow each call with an if block. It makes the code a lot less readable. Ideally I'd like to be able to weave in some chained method calls which would allow me to handle unexpected outcomes at each point (e.g. throw a meaningful exception such as new ConventionException("The report contains no parameter") if the first method returns an empty collection). Can anyone suggest a simple way to achieve such a thing?

    Read the article

< Previous Page | 6 7 8 9 10 11 12 13 14 15 16 17  | Next Page >