Re: Magic Quotes

[Brad Lhotsky <lhotskyb () mail nih gov>]

Well, it's good to hear that you're the one doing the pentesting.
However, the MagicQuotes does not solve the problem, it bandaids it.
The problem is bad programming, and regardless  of the Magic Quotes, if
the programmers developing the app are writing code like that, the
chances are,  Magic Quotes isn't going to take it from "insecure" to
"Secure", it'll just slide it ever so trivially closer to "secure".

Rest assured, that there will be projects like Hardened-PHP and
mod_security that will work with PHP6 to bandaid fix most common
programmer errors.  It's those interesting logic problems that people
who write "Select * from table where field=$value" introduce that will
ultimately leave the app insecure and open to attack.

DokFLeed wrote:
> Hi,
> I think you got my email wrong, this code isn't what I wrote, this code
> is a sample of a careless programmer who does not care about security
> issues, and fairly weak in development itself, however,  you can not
> compromise his server because it has magic quotes on.
> I have done lots of pen-testing and came across many websites, that even
> if they are hacked, the server is saved because of magic quotes.
> I hope that explains my argument.
>
> so let me put it this way, since the discussion moved from the How to Why.
> with a vulnerable weak code like that, and magic quotes are on, how can
> you get access to the server, knowing that you can inject to SELECT,
> INSERT statements , again with magic quotes on!
>
> cheers
> DokFLeed
>
>
> ----- Original Message ----- From: "Brad Lhotsky"
> <lhotskyb () grc nia nih gov>
> To: "DokFLeed" <dokfleed () dokfleed net>
> Cc: <webappsec () securityfocus com>; "Steve Slater"
> <slater () handsonsecurity com>
> Sent: Tuesday, October 17, 2006 1:21 AM
> Subject: Re: Magic Quotes

-- 
Brad Lhotsky <lhotskyb () grc nia nih gov>
NCTS Computer Specialist
Phone: 410.558.8006
"Freedom, Privacy, Security.  Choose Two."

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire was recently named the worldwide market leader in Web 
application security assessment tools by both Gartner and IDC. Download a 
free trial of AppScan today and see why more customers choose AppScan 
then any other solution.

https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008YTO
--------------------------------------------------------------------------