[REQUEST] ANTI SQL INJECTION

Is there any tutorial about this and how to protect yourself against them?
I keep gettin my index edited from vps and files deleted by someone using sql injection

Just finish login and password field with " where its missing

Use prepared statements or a framework.

programjer said:

Just finish login and password field with " where its missing

Click to expand...

im using znote for tfs 0.4 where can find this'

@Summ could u explain abitmore?

EstebanGod said:

im using znote for tfs 0.4 where can find this'

@Summ could u explain abitmore?

Click to expand...

there should be thing in like

so if "hacker" write something like.. they could do weird things... or even worse destroy the database typing

You can fix it by placing perl code like


Or just adding where its needed

THIS IS NOT TESTED, because i dont have time to do such things for everyone. But i think you get a point so you can easly fix it for yourself... if not then stop working on ots because you need knowledge to create such things (imagine if you have BUG in PAYMENT SYSTEM and you couldnt fix it).

#edit
IF YOU ARE REALLY UNSKILLED then you can try install software that block database commands. Just check https://www.modsecurity.org

@EstebanGod Just google "prepared statements mysql" or "mysql framework php", it is really not hard to use google.

Thanks alot information was really useful to me, Its just that there is too many info about sql injections on the internet I had already tried some scripts and other things but it didnt seem to work... Im already working on this

Znote AAC does not use prepared statements. Prepared statements are used to prevent human error, stupid things humans do which creates vulnerability.

In Znote AAC, just remember to fetch POST and GET variables using the getValue method and your all set. And you should not have any problems with SQL injections.

If you find any problems with the default Znote AAC files, especially in regard to security, please tell me. I have yet to find a hacker good enough to challenge my code, I would highly appreciate any attempts. Go nuts on http://demo.znote.eu/

Im actually using @Znote AAC 1.4 . Also using a custom layout.

Where exactly do i work this out?

"In Znote AAC, just remember to fetch POST and GET variables using the getValue method and your all set. And you should not have any problems with SQL injections."