i need help in sql injection n cross site scripting

[rita]

hi everybody........

tis is my first time here....i hope someone out there could help me...i have an assignment on sql and cross site scripting....based on this aspects i will have to discuss the probs of webpage vulnerability and how can it be resolved by the administrator....i have very little knowledge bout security....hope someone out there could help.......


regards
-rita-

 

[root]

The first line of defense against SQL injection should be data validation,
(and not just with javascript. -data should be validated server side)...
the second line would be not to use stored procedures, passing NULL data to a stored procedure is the quickest way to get table structure information from a website...

I'm sure if you use google you'll find a lot more information than any one person could give you.

 

[Novartic_]

allso for security thay use a scriped on only the pages that thay dont want you to see and to only bye pass that you need a login and password so that you can acsess these tight securiy pages, for this forum we use cookys wich keep you loged in on all pages so that you dont have to log back in all the time you want to post a reply or sumthing

 

[Novartic_]

SQL is used in data basing (acsess is usely used for this) and servers, as well as apachi, php (i think that this is made up from that), and theres many more as well as asp which is also used in the same prinseble as php dose but is old and more advaced.

 

[root]

SQL is structured Query language ad is used only to preform database queries.
PHP is the pre-processed hypertext language, and has the ability to interface with servers using the SQL language.
ASP is active server pages and again has the ability to interface with databases using the SQL query language.

PHP is written in C, whilst it has support to connect to a database and pass on SQL requests, it is not made, or based on SQL.

-hope that makes sense.

 

[Novartic_]

didnt mine then? o never mind as im dyslexic anyway nothing i say makes a lot of sence and its like im on a world of my own. he he he he.

 

[rita]

gee thnx a lot guys...ur the best.....i did get lots of info bout this threasts but i dont knw how to put it in my own words but now since u guys gave me few tips...i think i can manage...oncce more thnx.......lu u guys.....

 

[Novartic_]

use these we dont mind and hows the teacher going to find out?

 

[root]

didnt mine then? o never mind as im dyslexic anyway nothing i say makes a lot of sence and its like im on a world of my own. he he he he.

It wasn't that your words didn't make sense and it had nothing to do with your dyslexia.

What I said was the PHP was not based on SQL, and neither was ASP.

 

[Novartic_]

well combined. with users etc.. u use SQL to combine the three together.