fake code monkey rashid - Page 549

NLog Advanced Target

A simple way to log changes on your objects using NLog.

Fun with Google's new free text to speech engine using minimalistic approach

Google's new free TTS engine (used by android phone) jast sounds fantastic. Here is how to use it from c++

DICOM Image Viewer

A simple viewer of images stored in the DICOM 3.0 File Format (C#). The file should have raw pixel data, uncompressed. Window Level functionality is also provided.

Automatically Generate Maps and Directions with Google Apps Script

Following up on our recent post about the new Doc List capability in Google Apps Script, we thought we’d take a moment to look a little more closely...

Are SQL Injection vulnerabilities in a PHP application acceptable if mod_security is enabled?

I've been asked to audit a PHP application. No framework, no router, no model. Pure PHP. Few shared functions. HTML, CSS, and JS all mixed together. I've discovered numerous places where SQL injection would be easily possible. There are other problems with the application (XSS vulnerabilities, rampant inline CSS, code copy-pasted everywhere) but this is the biggest. Sometimes they escape inputs, not using a prepared query or even mysql_real_escape_string(), mind you, but using addslashes(). Often, though, their queries look exactly like this (pasted from their code but with columns and variable names changed): $user = mysql_query("select * from profile where profile_id='".$_REQUEST["profile_id"]."'"); The developers in question claimed that they were unable to hack their application. I tried, and found mod_security to be enabled, resulting in HTTP 406 for some obvious SQL injection attacks. I believe there to be sophisticated workarounds for mod_security, but I don't have time to chase them down. They claim that this is a "conceptual" matter and not a "practical" one since the application can't easily be hacked. Their internal auditor agreed that there were problems, but emphasized the conceptual nature of the issues. They also use this conceptual/practical argument to defend against inline CSS and JS, absence of code organization, XSS vulnerabilities, and massive amounts of repetition. My client (rightly so, perhaps) just wants this to go away so they can launch their product. The site works. You can log in, do what you need to do, and things are visibly functional, if slow. SQL Injection would indeed be hard to do, given mod_security. Further, their talk of "conceptual vs. practical" is rhetorically brilliant, considering that my client doesn't understand web application security. I worry that they've succeeded in making me sound like an angry puritan. In many ways, this is a problem of politics, not technology, but I am at a loss. As a developer, I want to tell them to toss the whole project and start over with a new team, but I face a strong defense from the team that built it and a client who really needs to ship their product. Is my position here too harsh? Even if they fix the SQL Injection and XSS problems can I ever endorse the release of an unmaintainable tangle of spaghetti code?

Search Results

Search found 88661 results on 3547 pages for 'fake code monkey rashid'.

Page 549/3547 | < Previous Page | 545 546 547 548 549 550 551 552 553 554 555 556 | Next Page >

- by Austin Smith

- by coder3

- by Kevin Gurney

- by ETC

- by chandan

- by fesja

< Previous Page | 545 546 547 548 549 550 551 552 553 554 555 556 | Next Page >