Development Discussion Board

The subject for the first post is the topic title.

naderman wrote:[..] That said, addslashes for SQL escaping is a very bad idea, you should rather use the correct escaping function for your database.

I heard this before, does that also apply when I'm only using MySQL? Why is it such a bad idea? And should one apply stripslashes() first with magic_quotes_gpc on?

naderman wrote:simple spoofing

I have been wondering about this, is it possible to perform SQL-injection with a spoofed $_SERVER['REMOTE_ADDR'] global? I usually run it through addslashes() when I'm storing it in a DB, but is that even necessary? There's not much I can find about this on Google.

Highway of Life wrote:

dkarlovi wrote:

• autoban on X warnings (it really puzzles me how come this didn't make it to 3.0)

I could see this as being useful, but I think the idea is for a human to make the decision to ban a user.

I believe the plan for 3.2 was to let you set this up through the events system?

And you can easily fake headers.

Can I still participate in this competition?

We could just show it, right?

I mainly just edited colours.css, along with some minor template/imageset changes.

You can find arnezami's posts on the doom9 forums, explaining how he cracked it and how people can benefit from the code..

http://forum.doom9.org/showthread.php?p ... post949426
http://forum.doom9.org/showthread.php?p ... post952889
http://forum.doom9.org/showthread.php?p ... post952954

This is nuts..

HTML isn't secure enough, that's why we have powerful custom BBCodes now..