Quotes in mysql queries – security issue

Remember to check numeric data as well. If an application generates a query such as SELECT * FROM table WHERE ID=234 when a user enters the value 234,the user can enter the value 234 OR 1=1 to cause the application to generate the query SELECT * FROM table WHERE ID=234 OR 1=1.As a result, the server retrieves every row in the table. This exposes every row and causes excessive server load. The simplest way to protect from this type of attack is to use single quotes around the numeric constants: SELECT * FROM table WHERE ID='234'.  If the user enters extra information, it all becomes part of the string. In a numeric context, MySQL automatically converts this string to a number and strips any trailing nonnumeric characters from it. It means that if the user enters 234myname the value remains 234. Another option is to do a check before the mysql query if the value is numeric.

Source http://dev.mysql.com/doc/refman/5.0/en/security-guidelines.html

Javascript Confirm Form Submission

Javascript Confirm Form Submission

Many times you may wish to have the user confirm, before they process a form’s action. For instance, clicking the button may activate a deletion process which you wish to have the user confirm before proceeding.

This code allows your users to confirm whether they wish to proceed when processing a form with serious consequences, such as DELETE. Continue reading “Javascript Confirm Form Submission”

friendly url with htaccess

suppose you want /articles.php?cat=$1&art=$2 to become magazine/1/2

then you need these two rules:

#articles.php?cat=$1&art=$2
RewriteRule ^magazine/([^/]*)/([^/]*)$ /articles.php?cat=$1&art=$2&marker [L]

RewriteCond %{REQUEST_URI} /articles\.php [NC]
RewriteCond %{QUERY_STRING} ^cat=(.*)&art=(.*)
RewriteCond %{QUERY_STRING} !marker

RewriteRule (.*) http://mydomain/%1/%2? [R=301,L]

AWStats logfile analyzer 6.95 Documentation

Glossary

Unique Visitor:
A unique visitor is a host that has made at least 1 hit on 1 page of your web site during the current period shown by the report. If this host make several visits during this period, it is counted only once.
The period shown by AWStats reports is by default the current month.
However if you use AWStats as a CGI you can click on the “year” link to have a report for all the year. In a such report, period is full year, so Unique Visitors are number of hosts that have made at least 1 hit on 1 page of your web site during those year. Continue reading “AWStats logfile analyzer 6.95 Documentation”