vBulletin Modifications

Do you use the GPC cleaning?

Welcome to vBHackers.com! - vBHackers Updates:

Go Back   vBulletin Modifications > General vBulletin Section > General vBulletin Discussion

Reply
 
LinkBack Thread Tools
Old 06-27-2006, 06:29 AM   #1
Advanced Coder
Niels's Avatar
Join Date: Jun 2004
Real Name: Niels
Location: NL
Niels is on a distinguished road

Default Do you use the GPC cleaning?

Well, in the past I didn't use vb's gpc cleaning solutions. But I'm now to a point that I'll start implenting them. Anyone got hints? Tricks? Or got some note's about it?




Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Sponsored Links
Old 06-27-2006, 08:15 AM   #2
Coder
bairy's Avatar
Join Date: Jun 2006
Real Name: Chris
Location: Birmingham, UK
bairy is on a distinguished road

Default

GPC is used to make sure that the only $_ inputs that are taken into account are the ones allowed by you (well, the coder).

Basically it works by taking the contents of $_POST and $_GET and looking at the list of variables to clean as set by you using gpc_clean_array.

So for example if you did
hello.php?alpha=foo&beta=bar&charlie=0

Then $_GET would contain alpha,beta,charlie. If you only specified alpha and beta to be cleaned then charlie would still be in the $_GET array (I think) but not in the GPC array. This is so that people can't inject extra variables into the $_GET or $_POST arrays.
Because they still exist in the $_GET array you should use GPC to make sure the script only sees what it's supposed to see.


As a special bonus variable types are set before going into GPC. So if you passed ?alpha=foo and it expected alpha as an INT or UINT, then it would return 0 thus possibly saving an error if you tried to insert a string into an int slot in sql, for example. Similarly if it expected a UINT (unsigned (non negative) int) and you passed -10 then it would reject it. I think it sets it to 0.


You probably ought to use GPC instead of referring to the $_ arrays directly. While not a major risk you never know who might take a shine to trying to inject stuff into the script.

Last edited by bairy; 06-27-2006 at 08:19 AM.




Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Old 06-27-2006, 09:20 AM   #3
Advanced Coder
Niels's Avatar
Join Date: Jun 2004
Real Name: Niels
Location: NL
Niels is on a distinguished road

Default

Thanks for the big reply! A really really good text. Learned alot from it.




Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


All times are GMT -3. The time now is 01:08 PM.


SEO by vBSEO 3.2.0 ©2008, Crawlability, Inc. (Patent Pending)