Log in

View Full Version : BUG: apostrophes kill the PM feature

fly
10-25-2006, 05:03 PM
I just had a user get the following SQL error:

mySQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'a'smooch', 'Your Highscore got beaten', '[size=1][i]This is an automatically gen' at line 1
mySQL error code:
Date: Wednesday 25th of October 2006 10:04:14 AM

The user's name is Mr. Wink'a'smooch.

I told him it was cause his name was horrible, but I thought I'd let you know anyway...
MrZeropage
10-26-2006, 08:47 AM
should be fixed in v2.5.7+ and work fine there :)
Ziki
10-26-2006, 12:57 PM
Dude sql injection!THis is a total hacking pie!
Don't forget addslashes!
fly
10-26-2006, 01:26 PM
omy

dfsafasd
MrZeropage
10-26-2006, 01:32 PM
This is all good in v2.5.7+ :)



and no injection-problem because only valid data (username and predefined texts) arrive there, no external data
Mark.B
10-26-2006, 02:01 PM
This is all good in v2.5.7+ :)



and no injection-problem because only valid data (username and predefined texts) arrive there, no external data
Any chance of a fix for this in earlier vesions when you get a moment?
Ziki
10-31-2006, 04:44 PM
This is all good in v2.5.7+ :)



and no injection-problem because only valid data (username and predefined texts) arrive there, no external data


But knowing this I can create an username for example ' OR ''=' OR '1'='1 or others like that :)