Since PHP 5.1.2 the hash function is enabled by default. To create a sha256 hash you simply write:

hash("sha256", $data, false);

There you have your sha256 hash!

SQL injections are common nowadays and plenty of sites get hacked because of insecure database calls.

Making it bulletproof against injections is hard and will take time, but making safer calls are essential and doesn’t take that long to make.

So, what is a SQL injection?

To clearify it I will give a very easy example:

A database may look something like this:
ID | USERNAME | PASSWORD

When you make a call to that database your query can look something like this:

SELECT * FROM database_name WHERE id = '2'

So far no problems.. But when you code it, it will be something like this (the insecure way):

$sql = "SELECT * FROM database_name WHERE id = '".$_POST['id']."'";

If you make that query and has a id that is “2″, there will be no problem, but if you change it to something else, you will get some problems.

What if $_POST[’id’] would contain something like: ‘ or 1=1– ?

The query would now be:

$sql = "SELECT * FROM database_name WHERE id = '' or 1=1--";

That would automaticly select the whole database since that “or 1=1″ definetly is true.

That was a very short description of what a SQL injection is so how can we now prevent without using any PDO? Using PDO may be the most secure way but requires more knowledge too.

Three lines of code will secure your code against the most known injections and will make it a lot harder to inject your site and hack it. One of this lines will take care of XSS hacking methods too:

1
2
3

$_POST = array_map("htmlspecialchars", $_POST);	# Will secure from XSS
$_POST = array_map("trim", $_POST); # Remove spaces before and after posts
$_POST = array_map("mysql_real_escape_string", $_POST); # Protects from most known SQL injections

Just add these lines in the top include file and you will always have your $_POST protected from the most known SQL injections. One easy way of securing your web applications a little further.

Google recently released a new REST API which will replace their old SOAP API (which they haven’t given out keys for since 2006)

This is very good news for those who want to do searchqueries “server-side”.

Documentation: http://code.google.com/apis/ajaxsearch/doc…entation/#fonje
Video: http://google-code-updates.blogspot.com/20…om-outside.html

Here’s some PHPcode of how to use this API:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

<?php
$url = “http://ajax.googleapis.com/ajax/services/search/web?v=1.0&q=Hello%20World”
 
// sendRequest
// note how referer is set manually
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_REFERER, “http://www.knark.com”);
$body = curl_exec($ch);
curl_close($ch);
 
// now, process the JSON string
$json = json_decode($body);
// now have some fun with the results…
?>

Here’s a compilation of some very funny and very geeky pictures! Have fun!

Yeah right!

Prepare!

Watch out!

Or not?

shitty:D

Haha.. Basic algebra you know!

Print this and use for your own safety;)

Insert where?

Remember to first google, then ask!


Based on ascii-characters, pretty nice.

Nice lego-art!

Handbag for your wife? Or maybe not..:D

Ethernet is roolling:D

I wonder if Bill Gates uses this one ;)

Podcast geek.

Ok.. Thats scary:)

…. But this is even more scary

Some rings for the geek!

yeeees.. just press it ffs!

And the grandé finale..

Tavis Ormandy is the guy from the Google Security Team who “makes it happend”.

He’s a researcher on the Google Security Team and faces the unpleasent responsibility of passing all googles products pass the security tests. Tavis is also an open-source contributer, working as a co-lead of the Gentoo Security Team as well. He is one of the faces that should make the Linux Gentoo distribution safe.

In September 2006, Tavis reported vulnerabilities in the gunzip decompressor on behalf of Google. Here is the link to the report made by Tavis: http://www.scary.beasts.org/security/tavis_gzip.txt

He has also discovered lot’s of other vulnerabilities such as PCRE (Perl Compitable Regular Expressions) and Perl Unicode Regular Expression buffer overflow. Links to these hacks can be found here: (PCRE) (UNICODE)

Summary: We should be glad of Tavis work since he’s making the web and the servers safer by contributing and telling the software creators before making the exploits public.

Here’s some collected links that can be interesting:
Tavis Ormandy’s blog
Secwatch profile
Milw0rm profile