Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:3910
Return-Path: <mosdoron@netvision.net.il>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 93632 invoked by uid 1007); 14 Aug 2003 08:19:08 -0000
Message-ID: <20030814081908.93491.qmail@pb1.pair.com>
To: internals@lists.php.net
References: <7BE0F4A5D7AED2119B7500A0C94C58AC3D6CCC@DELLSERVER>
Date: Thu, 14 Aug 2003 11:18:27 +0200
Lines: 23
MIME-Version: 1.0
Content-Type: text/plain;
	charset="windows-1255"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2720.3000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300
X-Posted-By: 212.199.103.105
Subject: Re: [PHP-DEV] Re: PHP 4.3.3RC3 Released
From: mosdoron@netvision.net.il ("moshe doron")


"Marc Boeren" <M.Boeren@guidance.nl> wrote in message
news:7BE0F4A5D7AED2119B7500A0C94C58AC3D6CCC@DELLSERVER...
>
> > that's the point. if the cracker can change only the end of
> > the query, it's not so usefull for him (he can maximum get other id)
>
> How about a form of dos:
>
> '...where id = '.$id
>
> with $id = '23129 or 1'
>
> this will select all entries in the table which could result in DoS...
>
> So, ultimately this problem is the coders responsibility.
>
DoS are not equivalent to droping the whole database (in the fast and soft
case...).
most of the system allowing searches, can be DoSed easily.

moshe