PHP Warning: Undefined array key "rating" in ..../includes/class_postbit.php(368) : eval()'d code on line 68
[Tips] Writing more secure hacks - vb.org Archive
Go Back   vb.org Archive > vBulletin Article Depository > Read An Article > vBulletin 3 Articles
Reload this Page [Tips] Writing more secure hacks
Register FAQ Community Calendar Today's Posts Search

Reply
 
Thread Tools
[Tips] Writing more secure hacks
Revan's Avatar
Revan
Join Date: Jan 2004
Posts: 1,671

Started doing my first if...else chain in 2004, and released my first major vBulletin modification in August 2004 with the first version of the RPG Integration Hack.

Norway
Show Printable Version Email this Page Subscription
Revan Revan is offline 01-16-2005, 10:00 PM
I decided to write this because I am bored, and because I felt like sharing something that may be useful to people writing modifications to vBulletin code.
Now I realise that some of this may be obvious to you, but I am still young enough to remember myself asking questions that is now common sense to me.
Enough banter, onto the good stuff!
  1. Use vBulletin's globalize() when parsing GET/POST data

    This can be useful not only for avoiding SQL Injections, it also saves you trouble by running intval() on things that really HAVE to be of integer, etc.


  2. If you find you cannot use globalize(), use it's functions anyways

    For instance, I have an array consisting of arrays. I have an array of items, which each contains an array of values. All of this needs to be updated in the SQL.
    Trying to use "=> INT" , "=> STR" or anything, results in errors.
    You have to use blank datatype (IE no "=>").
    It is then adviced to, inside the SQL query, run the functions globalize() normally would run.
    The globalize() is located in the file /includes/functions.php (Thanks deathemperor )


  3. When running globalize(), use "=> STR_NOHTML" if HTML is not needed.

    Not too much to comment on this, the only possible security issue this would pose was if this function was run in a /modcp/ file, and the moderator had an urge to run some JavaScript he shouldn't... :ermm:


  4. Always match up GET/POST values against stored values

    For instance, if you have a Shop mod, do not directly update the user's cash based on the cost of the item bought.
    Adding another check to a variable containing the amount of cash an user got will pevent users from being able to go into negative amounts.
    Now you may think "but he *will* go into negative amounts so he *will* have to pay". True as that may be, if they exploited it once, do you think they will go "Ok, I got my item. I must now go pay the cost and never exploit this again"?
    Neeeh...


  5. Do not think POST is safe

    Even if you use POST to prevent the above exploit, it will only fool the most basic of users.
    Not only is it easy to make it accept GET values simply by using something like "script.php?select=name&cash=1000", but Firefox browser even has an extension called "Web Developer", which allows you to convert POST to GET and vice versa.


  6. Never ever directly use variables containing strings in SQL queries.

    addslashes() is your friend. If your completely unable to run anything of the above, at least run this.
    (Thanks KirbyDE )


  7. Never ever assume an integer, especially one that comes from an input, is actually an integer.

    intval() is also your friend.
    (Thanks sabret00the )


  8. Ready to leave vB's safe haven?

    Security Notes. This is a great piece of reading, thoroughly explaining all advice given and doesn't use language assuming we are all developers of the PHP program itself.
    (Thanks Guy G )


(This is possibly incomplete. I cannot think of anything more at the time of writing. Feel free to comment on things to add! )
Reply With Quote
  #2  
Old 01-17-2005, 08:32 AM
Andreas's Avatar
Andreas Andreas is offline
 
Join Date: Jan 2004
Location: Germany
Posts: 6,863
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
6. Never ever directly use variables containing strings in SQL queries. Always use addslashes().
Reply With Quote
  #3  
Old 01-17-2005, 09:16 AM
sabret00the's Avatar
sabret00the sabret00the is offline
 
Join Date: Jan 2003
Location: London
Posts: 5,268
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
7. run integers through
PHP Code:
intval()
before you echo them out into the query
Reply With Quote
  #4  
Old 01-17-2005, 12:33 PM
deathemperor's Avatar
deathemperor deathemperor is offline
 
Join Date: Jul 2003
Location: HOL
Posts: 1,270
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
globalize() is on functions.php I believe, it stores all golbal functions, if a functions was written for newpost then it should be in function_newpost.php or similar,

nice tips Revan.
Reply With Quote
  #5  
Old 01-17-2005, 06:31 PM
Guy G Guy G is offline
 
Join Date: Nov 2004
Posts: 250
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Here is another excellent about security of your scripts(PHP in general):
http://forums.devshed.com/t20525/s.html
Reply With Quote
  #6  
Old 01-19-2005, 07:41 PM
Revan's Avatar
Revan Revan is offline
 
Join Date: Jan 2004
Location: Norway
Posts: 1,671
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by KirbyDE
6. Never ever directly use variables containing strings in SQL queries. Always use addslashes().
Added, thanks

Quote:
Originally Posted by sabret00the
7. run integers through
PHP Code:
intval()
before you echo them out into the query
Same as above

Quote:
Originally Posted by deathemperor
globalize() is on functions.php I believe, it stores all golbal functions, if a functions was written for newpost then it should be in function_newpost.php or similar,

nice tips Revan.
Again...

Quote:
Originally Posted by Guy G
Here is another excellent about security of your scripts(PHP in general):
http://forums.devshed.com/t20525/s.html
And for the last time in this post: Thanks
XD


//peace
Reply With Quote
Reply

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 04:12 AM.

Contact Us - Archive - Privacy Statement - Top

Powered by vBulletin® Version 3.9.0
Copyright ©2000 - 2017, vBulletin Solutions Inc.