Welcome to HBH! If you have tried to register and didn't get a verification email, please using the following link to resend the verification email.

SQL Injection


ghost's Avatar
0 0

Is any sql injection possible if magic_quotes_gpc is set to on?


ghost's Avatar
0 0

try %2527 just out the top of my head though


ghost's Avatar
0 0

Anarcho %2527 is ' in url decode, so it could be use to bypass the filters (but only if magic quotes is set to off - and programmer made bad filters).

After some exploring I discovered that with magic quotes set to on (which btw sux), we can't preform sql inject (correct me if it is wrong), same is with right caracters escaping. In most of servers magic quotes is set to ON (also by default), so I wondering how are all this forums and portals so vulnerable to sql inject. (Do they manual disable magic quotes or what)??

I am not realy sure if this theory is right but I am realy interesting about it.