Hello.
Can someone advise how I should at least somewhat secure the php scripts on the server side?
Namely: there was a hack in one table ... unknown 10.31.20.12:80 "completed" meaningless rows for me there...
I looked at the access_log, I changed the database password, but I don't know what else to do to prevent it from happening again...
Senior1954
Let me suggest you to first get everything up and running and then take care of security
Taifun
Why not introduce a secret key, in the same way that Taifun shows in his mysql tutorial. It is a start...
Hello.
I tried again with Taifun's php from mysql tutorial with secret key ...
key and query are:
[["key","secrettt"],["query","SELECT * FROM tblCisAlkohol"]]
Where am I doing wrong?
Senior1954
When I sent it .... I guess I see an error ...
In the app there is "key" ... and in php "SQLKEY".
Maybe this is the mistake?
Senior1954
if($_POST['key']==$SQLKEY){ //validates the SQL key
$query=urldecode($_POST['query']);
$conn = new mysqli($DB_ADDRESS,$DB_USER,$DB_PASS,$DB_NAME); //connect
Hello.
I use the php script from
does not work...
There is exactly the If as you sent me...
Question:
There is something like:
$key=$_POST["key"];
$query=$_POST["query"];
?
I do not understand that....
I only need a simple script where there is a key and a query.
I create a query in the app and send it to the server...
So far, I have created a php command only on the server in php ... for example:
$input=mysqli_query($conn, "INSERT INTO tblCisAlkohol (ID, Name) VALUES (NULL,'$Name')");
that's probably why they hated me...
Senior1954
hack me
Probably given you this link before:
Well, if you exactly follow the setup instructions then you also will be able to use it... you are not the first person using that solution...
Just use your working setup from here
together with my script
Taifun
Do some simple tests:
basic.php:
<?php
echo "secret\r\n";
?>
curl -X POST https://..../basic.php
better.php:
<?php
$SQLKEY="secret";
if ($_POST['key']==$SQLKEY) {
echo "key and SQLKEY are a match\r\n";
} else {
echo "key is incorrect\r\n";
}
?>
curl -d "key=secret" https://.../better.php
(note the \r\n are used to ensure a line return in my terminal)
Test result: key is incorrect
Really ?
:~$ curl -d "key=secret" https://.../better.php
key and SQLKEY are a match
Show YOUR php file for this, and the command you sent. (or blocks used)
Can you make a "better.php" with the code provided and just test that ?
Unfortunately, the result is: key is incorrect
Show all your blocks for making the connection....
Why all those blocks ?
You only need the blocks I showed above...
Just create a new test project!
