Re: [PHP] Fwd: Is it possible???

2013-06-25 Thread php
On Mon, Jun 24, 2013 at 06:17:33PM +0200, Maciek Sokolewicz wrote: Please please please please don't do this! 1) You did not answer the question, nor giving any related information. 2) This was debug-output. I see not point in optimizing. 3) print is language construct, just as is echo 4)

[PHP] Thread-Hijacking (was: Re: [PHP] Fwd: Is it possible???)

2013-06-25 Thread Tamara Temple
Maciek Sokolewicz maciek.sokolew...@gmail.com wrote: Please please please please don't do this! Please Please Please Do Not Hijack Threads. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

[PHP] Re: Thread-Hijacking (was: Re: [PHP] Fwd: Is it possible???)

2013-06-25 Thread Maciek Sokolewicz
On 25 June 2013 10:02, Tamara Temple tamouse.li...@gmail.com wrote: Maciek Sokolewicz maciek.sokolew...@gmail.com wrote: Please please please please don't do this! Please Please Please Do Not Hijack Threads. Hijacking would be starting a completely different discussion in the same thread.

[PHP] Fwd: Is it possible???

2013-06-24 Thread Karl-Arne Gjersøyen
/24 Subject: Is it possible??? To: PHP Mailinglist php-general@lists.php.net $item_amount_in_store = 223; $update_amount = 7; $update_item_amount_in_store += $update_amount; $update_amoint_in_store is now 227; Why? That should be 230! Karl -- Hjemmeside: http://www.karl-arne.name/

Re: [PHP] Fwd: Is it possible???

2013-06-24 Thread Stuart Dallas
) -Stuart -- Stuart Dallas 3ft9 Ltd http://3ft9.com/ -- Forwarded message -- From: Karl-Arne Gjersøyen karlar...@gmail.com Date: 2013/6/24 Subject: Is it possible??? To: PHP Mailinglist php-general@lists.php.net $item_amount_in_store = 223; $update_amount = 7

Re: [PHP] Fwd: Is it possible???

2013-06-24 Thread nobs
You should give a complete programm so we can run exactly the same you do, like this: ?php $item_amount_in_store = 223; print ($item_amount_in_store); $update_amount = 7; $item_amount_in_store += $update_amount; print ( + $update_amount = $item_amount_in_store ); ? which gives this result:

Re: [PHP] Fwd: Is it possible???

2013-06-24 Thread Sachin Raut
: 2013/6/24 Subject: Is it possible??? To: PHP Mailinglist php-general@lists.php.net $item_amount_in_store = 223; $update_amount = 7; $update_item_amount_in_store += $update_amount; $update_amoint_in_store is now 227; Why? That should be 230! Karl -- Hjemmeside: http://www.karl

Re: [PHP] Fwd: Is it possible???

2013-06-24 Thread Maciek Sokolewicz
On 24-6-2013 14:27, n...@nobswolf.info wrote: You should give a complete programm so we can run exactly the same you do, like this: ?php $item_amount_in_store = 223; print ($item_amount_in_store); Please please please please don't do this! First of all, I don't know why you would use the

Re: [PHP] Fwd: Is it possible???

2013-06-24 Thread Carlos Medina
Amen! Am 24.06.2013 18:17, schrieb Maciek Sokolewicz: On 24-6-2013 14:27, n...@nobswolf.info wrote: You should give a complete programm so we can run exactly the same you do, like this: ?php $item_amount_in_store = 223; print ($item_amount_in_store); Please please please please

Re: [PHP] Fwd: Is it possible???

2013-06-24 Thread Marco Behnke
Am 24.06.2013 18:17, schrieb Maciek Sokolewicz: On 24-6-2013 14:27, n...@nobswolf.info wrote: You should give a complete programm so we can run exactly the same you do, like this: ?php $item_amount_in_store = 223; print ($item_amount_in_store); Please please please please don't do this!

Re: [PHP] How is this possible???? (addslashes)

2011-02-17 Thread Paul S
On Thu, 17 Feb 2011 07:50:45 +0700, Daniel Brown paras...@gmail.com wrote: No offense, but are you kidding me? The host disables phpinfo() for security reasons, but keeps 4.4.4 running? Talk about running, Paul run away from them. Fast. AND they have a condition (this reported)

[PHP] How is this possible???? (addslashes)

2011-02-16 Thread Paul S
Can anyone please tell me how the addslashes output (note = Everyone''s a card on the \earth) in the following example is possible. It is addslashes output but this result is consistent with the output from post when runtime is set: 1): a single quote is inserted before a single quote and nothing

Re: [PHP] How is this possible???? (addslashes)

2011-02-16 Thread Daniel Brown
On Feb 16, 2011 7:07 PM, Paul S pau...@roadrunner.com wrote: Can anyone please tell me how the addslashes output (note = Everyone''s a card on the \earth) in the following example is possible. It is addslashes output but this result is consistent with the output from post when runtime is set:

[PHP] Re: Is it possible to create a global namespace alias?

2010-10-05 Thread Matt Palermo
I'm assuming there is no way to make a global alias. Can anyone confirm/deny this? Matt Palermo wrote in message news:5e7b8989448b45dbbeeb6fb89b3f3...@rachet... Is it possible to create a global namespace alias in PHP or does the alias have to be defined in EVERY file that I use? Here

Re: [PHP] Re: Is it possible to create a global namespace alias?

2010-10-05 Thread David Harkness
On Tue, Oct 5, 2010 at 8:41 AM, Matt Palermo palermom...@gmail.com wrote: I'm assuming there is no way to make a global alias. Can anyone confirm/deny this? I reread the documentation on namespaces, and from what I can tell this is no way to do it. Each file maintains its own active

[PHP] SOAPParam - Does it possible?

2010-07-09 Thread Augusto Flavio
Hi, I'm creating a wsdl server but I have one doubt about the soapparam::soapparam(). I want to know how to return several parameters using the soapparam::soapparam(). I'm doing this: class MyApi implements API { public function Send($param) { $resp = array('resposta' = 'works',

[PHP] How is this possible?

2009-10-28 Thread tedd
Hi gang: I am reviewing some old code (circa 2003) where the programmer had one script call another and placed variable values in the URL, like so: a href=user_edit.php?user_id=5223action=edit That seems innocent enough. However, in the called script (i.e., user_edit.php) there are no:

Re: [PHP] How is this possible?

2009-10-28 Thread David Otton
2009/10/28 tedd t...@sperling.com: Hi gang: http://php.net/manual/en/security.globals.php -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] How is this possible?

2009-10-28 Thread Adam Randall
I don't do this personally, but you can probably get your script working by doing something like this: foreach( $_GET as $k = $v ) $$k = $v; You would put that at the top of your page, but be aware that it allows other people to set variables on your page (just like register globals does). If

Re: [PHP] How is this possible?

2009-10-28 Thread Andrew Ballard
On Wed, Oct 28, 2009 at 1:27 PM, tedd t...@sperling.com wrote: Hi gang: I am reviewing some old code (circa 2003) where the programmer had one script call another and placed variable values in the URL, like so:    a href=user_edit.php?user_id=5223action=edit That seems innocent enough.

Re: [PHP] How is this possible?

2009-10-28 Thread Ashley Sheridan
On Wed, 2009-10-28 at 13:47 -0400, Andrew Ballard wrote: On Wed, Oct 28, 2009 at 1:27 PM, tedd t...@sperling.com wrote: Hi gang: I am reviewing some old code (circa 2003) where the programmer had one script call another and placed variable values in the URL, like so: a

Re: [PHP] How is this possible? [Solved]

2009-10-28 Thread tedd
To all: I found the problem, which basically was that I had declared a variable in a preceding script with the same name, namely $user_id. When I changed my script to $u_id, everything worked as before. Clearly, Globals are evil. It's a bitch to have to work with code you can't change

RE: [PHP] How is this possible? [Solved]

2009-10-28 Thread Bob McConnell
From: tedd I found the problem, which basically was that I had declared a variable in a preceding script with the same name, namely $user_id. When I changed my script to $u_id, everything worked as before. Clearly, Globals are evil. It's a bitch to have to work with code you can't

Re: [PHP] How is this possible? [Solved]

2009-10-28 Thread Robert Cummings
Bob McConnell wrote: From: tedd I found the problem, which basically was that I had declared a variable in a preceding script with the same name, namely $user_id. When I changed my script to $u_id, everything worked as before. Clearly, Globals are evil. It's a bitch to have to work with

Re: [PHP] How is this possible? [Solved]

2009-10-28 Thread tedd
At 2:48 PM -0400 10/28/09, Robert Cummings wrote: Bob McConnell wrote: From: tedd I found the problem, which basically was that I had declared a variable in a preceding script with the same name, namely $user_id. When I changed my script to $u_id, everything worked as before. Clearly,

Re: [PHP] How is this possible? [Solved]

2009-10-28 Thread Jim Lucas
tedd wrote: At 2:48 PM -0400 10/28/09, Robert Cummings wrote: Bob McConnell wrote: From: tedd I found the problem, which basically was that I had declared a variable in a preceding script with the same name, namely $user_id. When I changed my script to $u_id, everything worked as before.

Re: [PHP] Problems with APC, possible cache-corruption?

2009-06-22 Thread Nathan Nobbe
On Sun, Jun 21, 2009 at 6:17 PM, James McLean james.mcl...@gmail.comwrote: On Mon, Jun 22, 2009 at 9:40 AM, Nathan Nobbequickshif...@gmail.com wrote: On Sun, Jun 21, 2009 at 5:56 PM, James McLean james.mcl...@gmail.com wrote: did you take a look at the size of the cache you created ?

Re: [PHP] Problems with APC, possible cache-corruption?

2009-06-22 Thread James McLean
On Tue, Jun 23, 2009 at 6:17 AM, Nathan Nobbequickshif...@gmail.com wrote: hmm, 2 other thoughts i have.. . long shot, but do you have apc.php installed on a diff domain than the moodle app (not sure but i suspect apc.php only shows cached values for the domain in which its currently running

[PHP] Problems with APC, possible cache-corruption?

2009-06-21 Thread James McLean
(Resend from around 1 week ago, because of no responses) Hi All, Over the weekend I setup a test of APC intending to benchmark a Moodle installation with various APC settings to see how well I could get it to perform. I successfully installed Moodle 1.9 and 2.0 under Apache 2.2.3 (installed via

Re: [PHP] Problems with APC, possible cache-corruption?

2009-06-21 Thread Nathan Nobbe
On Sun, Jun 21, 2009 at 5:56 PM, James McLean james.mcl...@gmail.comwrote: (Resend from around 1 week ago, because of no responses) Hi All, Over the weekend I setup a test of APC intending to benchmark a Moodle installation with various APC settings to see how well I could get it to

Re: [PHP] Problems with APC, possible cache-corruption?

2009-06-21 Thread James McLean
On Mon, Jun 22, 2009 at 9:40 AM, Nathan Nobbequickshif...@gmail.com wrote: On Sun, Jun 21, 2009 at 5:56 PM, James McLean james.mcl...@gmail.com wrote: did you take a look at the size of the cache you created ? Yes. Tried multiple segments and single, with cache size values between 128mb and

Re: [PHP] Problems with APC, possible cache-corruption?

2009-06-21 Thread Jonathan Tapicer
Can you do a phpinfo(); and tell us the value of the setting apc.filters (or every apc.* if you can)? Just curious, but I've seen apps set that setting to avoid APC opcode caching. Jonathan On Sun, Jun 21, 2009 at 8:56 PM, James McLeanjames.mcl...@gmail.com wrote: (Resend from around 1 week

Re: [PHP] Problems with APC, possible cache-corruption?

2009-06-21 Thread James McLean
On Mon, Jun 22, 2009 at 10:02 AM, Jonathan Tapicertapi...@gmail.com wrote: Can you do a phpinfo(); and tell us the value of the setting apc.filters (or every apc.* if you can)? Just curious, but I've seen apps set that setting to avoid APC opcode caching. Certainly, however it will have to

[PHP] No Database Connection possible (mySQL)

2008-07-04 Thread Aviation Coding
Hi all, I am having problems with a connection to a mysql database. I am using function con() { mysql_connect(localhost,user,pass) or die(mysql_error()); mysql_select_db(tava) or die(mysql_error()); } Now, when I call the _function_ (!) con() or die(no con); I get the no

[PHP] FW: [SPAM] [PHP] No Database Connection possible (mySQL)

2008-07-04 Thread Chris Scott
-Original Message- From: Aviation Coding [mailto:[EMAIL PROTECTED] Sent: Friday, July 04, 2008 10:15 AM To: php-general@lists.php.net Subject: [SPAM] [PHP] No Database Connection possible (mySQL) Importance: Low Hi all, I am having problems with a connection to a mysql database

RE: [PHP] FW: [SPAM] [PHP] No Database Connection possible (mySQL)

2008-07-04 Thread Chris Haensel
-Original Message- From: Chris Scott [mailto:[EMAIL PROTECTED] Sent: Friday, July 04, 2008 11:41 AM To: php-general@lists.php.net Subject: [PHP] FW: [SPAM] [PHP] No Database Connection possible (mySQL) Importance: Low -Original Message- From: Aviation Coding [mailto:[EMAIL

[PHP] Re: Is it possible to get the name of the top most calling script?

2007-06-10 Thread Al
If the scripts are using a common file, [e.g., config, functions, etc.] you could define two constants. define(ORG_FILE, __FILE__); define(ORG_LINE, __LINE__); barophobia wrote: Hello, I know that __FILE__ and __LINE__ report on the file and line that they occur in. What I want is to be able

[PHP] Re: Is this possible with php

2006-03-06 Thread Al
Mace Eliason wrote: Hi, I really don't think this is possible from what I know of php, but I thought I would as the experts. Is it possible to have php create directories and move files on a local machine. I have

Re: [PHP] Re: Is this possible with php

2006-03-06 Thread Austin Denyer
(Re-sending as I accidentally sent my original post directly to Al) Al wrote: Mace Eliason wrote: I really don't think this is possible from what I know of php, but I thought I would as the experts. Is it possible to have php create directories and move files on a local machine. I have

[PHP] Re: Is this possible with php

2006-03-06 Thread João Cândido de Souza Neto
: Hi, I really don't think this is possible from what I know of php, but I thought I would as the experts. Is it possible to have php create directories and move files on a local machine. I have created a web portal for a client and now they would like it to upload files

Re: [PHP] Re: Is this possible with php

2006-03-06 Thread Robert Cummings
: Hi, I really don't think this is possible from what I know of php, but I thought I would as the experts. Is it possible to have php create directories and move files on a local machine. I have created a web portal for a client and now they would like it to upload files

Re: [PHP] Re: Is this possible with php

2006-03-06 Thread João Cândido de Souza Neto
would as the experts. Is it possible to have php create directories and move files on a local machine. I have created a web portal for a client and now they would like it to upload files to an server, no a problem. But they would like it to also move temp files on the users computer to new

Re: [PHP] Re: Is this possible with php

2006-03-06 Thread tg-php
: Hi, I really don't think this is possible from what I know of php, but I thought I would as the experts. Is it possible to have php create directories and move files on a local machine. I have created a web portal

[PHP] Re: Is it possible to use header() to POST form data?

2005-12-15 Thread Gustavo Narea
Hello. pw wrote: Does anyone know if it's possible to use the header() function to POST form data to a URL? If so what syntax needs to be used? I guess you cannot use the header() function in that way. Take a look at the header() documentation http://php.net/header. What do you need to

[PHP] Re: PHP CLI - possible for mass mailing?

2005-09-28 Thread Manuel Lemos
Hello, on 09/27/2005 02:44 AM Denis Gerasimov said the following: I was said that using Perl script is more suitable for such task since PHP scripts have problems with sending large amount of mail. Is that true or not? Any success/failure stories? It is a myth that Perl is better (or worse)

[PHP] Re: Is it possible to get the whole address (including http:// ) ?

2005-04-21 Thread Jason Barnett
Labunski wrote: Hello, I know for example how to get http vars or basename, but this time I need to get the whole address, including http:// . Is it possible? Thanks in advance, Lab. http://php.net/reserved.variables ?php var_dump($_SERVER['REQUEST_URI']); ? -- Teach a man to fish...

[PHP] Why is it possible to assign data to _not_declared_ vars in a class (PHP 5.0.3)?

2005-04-08 Thread Johannes Findeisen
Hello All, Why is this working? ?php class foobar { public $a, $b; public function __construct() { $this-a = Hello ; $this-b = world! ; $this-c = Good bye... ; } public function foo() { echo $this-a.br; echo $this-b.br; echo

[PHP] Re: Is it Possible?

2005-02-04 Thread Jason Barnett
Sagar C Nannapaneni wrote: I'm calling a php script with img tag for ex: img src=http://localhost/test.php?img=asfd; and the test.php is as follows... test.php ? some server side validations readfile(abcd.gif); ? --- Theres no

Re: [PHP] Is this even possible?

2005-01-24 Thread Jason Barnett
Tony Di Croce wrote: Is it even possible to connect to a postgres server (thats running on linux) from a windows CLI php script? I'm seeing a pg_connect() error... FATAL: no pg_hba.conf entry for host 192.168.1.100 Any ideas? The easiest way to get PG up and running on a Windows system is cygwin.

Re: [PHP] Is this even possible?

2005-01-24 Thread Greg Donald
On Mon, 24 Jan 2005 10:28:09 -0500, Jason Barnett [EMAIL PROTECTED] wrote: Tony Di Croce wrote: Is it even possible to connect to a postgres server (thats running on linux) from a windows CLI php script? Yup. I'm seeing a pg_connect() error... FATAL: no pg_hba.conf entry for host

RE: [PHP] Is this even possible?

2005-01-23 Thread Mikey
-Original Message- From: Tony Di Croce [mailto:[EMAIL PROTECTED] Sent: 22 January 2005 23:21 To: php-general@lists.php.net Subject: [PHP] Is this even possible? Is it even possible to connect to a postgres server (thats running on linux) from a windows CLI php script? I'm seeing

[PHP] Is this even possible?

2005-01-22 Thread Tony Di Croce
Is it even possible to connect to a postgres server (thats running on linux) from a windows CLI php script? I'm seeing a pg_connect() error... FATAL: no pg_hba.conf entry for host 192.168.1.100 Any ideas? -- td -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit:

Re: [PHP] Is this even possible?

2005-01-22 Thread Jason Wong
On Sunday 23 January 2005 07:20, Tony Di Croce wrote: Is it even possible to connect to a postgres server (thats running on linux) from a windows CLI php script? Yes. I'm seeing a pg_connect() error... FATAL: no pg_hba.conf entry for host 192.168.1.100 Exactly. So put the appropriate entry

[PHP] Are server classes possible?

2004-10-12 Thread Jed R. Brubaker
I am thinking like JavaBeans. Here is what I have going on: I have a series of rather database intensive queries that I would like some class to cache and provide access for page loads. I don't care how the information is stored, but I am trying to minimize the database call down to only once

Re: [PHP] Are server classes possible?

2004-10-12 Thread Adrian Madrid
I have used Turck MMCache in the past to store results in shared memory with an specific TTL. Also you could use Cache_Lite in PEAR. Hope it helps, Adrian Madrid Jed R. Brubaker wrote: I am thinking like JavaBeans. Here is what I have going on: I have a series of rather database intensive

[PHP] objects - is that possible at runtime in php4 or php5 ?

2004-10-04 Thread Alawi Albaity
I want to create and defined variables of an object in runtime , is that possible ? I can do that with arrays but I want the access it as variable from obbject it self and not like member of an array are defined on object before I load it ! -- Alawi Albaity Jeddah - KSA Mobile : +966506660442

Re: [PHP] objects - is that possible at runtime in php4 or php5 ?

2004-10-04 Thread Marek Kilimajer
Alawi Albaity wrote: I want to create and defined variables of an object in runtime , is that possible ? I can do that with arrays but I want the access it as variable from obbject it self and not like member of an array are defined on object before I load it ! What about trying it before asking?

[PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Saqib . N . Ali
Hello All, I am working on securing an application that uses CDSSO (Cross Domain Single Sign On). I am trying to reproduce the CSRF (Cross Site Request Forgery) attack (using img/ TAG) in I.E. 6.01, but am unable to do so. However the attack works on Mozilla and other older browsers. My

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Jay Blanchard
[snip] I am working on securing an application that uses CDSSO (Cross Domain Single Sign On). I am trying to reproduce the CSRF (Cross Site Request Forgery) attack (using img/ TAG) in I.E. 6.01, but am unable to do so. However the attack works on Mozilla and other older browsers. My

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Vail, Warren
PROTECTED] Sent: Monday, August 16, 2004 10:57 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? [snip] I am working on securing an application that uses CDSSO (Cross Domain Single Sign On). I am trying to reproduce the CSRF

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? WOT

2004-08-16 Thread Jay Blanchard
[snip] Perhaps the question could be asked another way and be more on topic. Is there a fix in I.E. 6.01 that would interfere with PHP being able to generate different mime types on the fly, like .png or .jpg [/snip] a. But that wasn't what he asked. 2. Top-posting === bad -- PHP General

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- Jay Blanchard [EMAIL PROTECTED] wrote: You would have to ask the Microsoft Development Group, who probably does not subscribe to this list. Crossposting is bad. Being OT during a crosspost is even worse. I can hear the falmethrowers warming up in the wings. FYI - This is (or use to be)

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread John Nichel
Jay Blanchard wrote: FYI - This is (or use to be) a PHP list If I have a web server running php, how do I change the oil in my car? -- John C. Nichel ÜberGeek KegWorks.com 716.856.9675 [EMAIL PROTECTED] -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit:

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- [EMAIL PROTECTED] wrote: My question: Is I.E. 6.01 SP1 doing something to foil the CSRF attack, i.e. only allow image extensions .gif .png .jpeg? This seems highly unlikely. Can you show us the code you're using to test? Chris = Chris Shiflett - http://shiflett.org/ PHP Security

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? WOT

2004-08-16 Thread Chris Shiflett
--- Jay Blanchard [EMAIL PROTECTED] wrote: [snip] Perhaps the question could be asked another way and be more on topic. Is there a fix in I.E. 6.01 that would interfere with PHP being able to generate different mime types on the fly, like .png or .jpg [/snip] a. But that wasn't

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Saqib . N . Ali
] To Jay Blanchard [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] cc Subject RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? --- Jay Blanchard [EMAIL PROTECTED] wrote: You would have to ask the Microsoft Development Group, who probably does not subscribe

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Jay Blanchard
[snip] Yup I think my posting is very on-topic. The application that I am working on is written in PHP. [/snip] Thanks for stating that in your original post.

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Saqib . N . Ali
downloads.seagate.com Chris Shiflett [EMAIL PROTECTED] No Phone Info Available 08/16/2004 11:24 AM Please respond to [EMAIL PROTECTED] To [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] cc Subject Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1? --- [EMAIL PROTECTED] wrote: My question

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- [EMAIL PROTECTED] wrote: And I m sure all PHP developers check their applications for CSRF vulnerability, in various browsers (including I.E. ). I speak about CSRF in many of the talks I give, and I think you'd be surprised by how many people haven't even heard of it. As a PHP/Java

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- [EMAIL PROTECTED] wrote: I can't share the exact code ;) , but here is something very similar: img src=http://slashdot.org/my/logout; height=1 width=1 If I load a web page with the above code, it should log me out of slashdot. It works in Mozilla (and netscape), but not in I.E. 6.01

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Ed Lazor
-Original Message- Jay Blanchard wrote: FYI - This is (or use to be) a PHP list If I have a web server running php, how do I change the oil in my car? Have you tried the OilChange class from PHPClasses.org? ;) -Ed -- PHP General Mailing List (http://www.php.net/) To unsubscribe,

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Ed Lazor
What if you add a random seed to the URL? img src=http://slashdot.org/my/logout?fluff=?php echo rand(1,200);? height=1 width=1 -Original Message- Hello Chris, I can't share the exact code ;) , but here is something very similar: img src=http://slashdot.org/my/logout; height=1

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Ed Lazor
-Original Message- The best information would be if you can capture the exact HTTP transactions involved. For example, using something like ethereal, capture the request and response for Mozilla, and then do the same for IE 6.01 SP1. Short of that, you could create a URL

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- Ed Lazor [EMAIL PROTECTED] wrote: Wouldn't it work to just make the script spit out a mime type header and a small (1x1) image when it's done to satisfy the browser's mime type requirements? Definitely, but most CSRF attacks are meant to spoof a request from the legitimate user to some Web

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Ed Lazor
-Original Message- Definitely, but most CSRF attacks are meant to spoof a request from the legitimate user to some Web site where he/she already has privilege. Thus, the receiving site is usually as much the victim as the user. I'm not sure if that makes any sense... :-) It does =)

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Octavian Rasnita
16, 2004 9:52 PM Subject: RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? --- [EMAIL PROTECTED] wrote: And I m sure all PHP developers check their applications for CSRF vulnerability, in various browsers (including I.E. ). I speak about CSRF in many of the talks I give, and I think

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Saqib . N . Ali
PROTECTED], [EMAIL PROTECTED] Subject Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1? Why is so important if Internet Explorer allows URLS of images where the file name is only .jpg, .png, or .gif? A url can be something like: http://www.site.com/script.php/image.jpg?logout=true Internet

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Saqib . N . Ali
] To [EMAIL PROTECTED], [EMAIL PROTECTED] cc [EMAIL PROTECTED], [EMAIL PROTECTED] Subject Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1? --- [EMAIL PROTECTED] wrote: I can't share the exact code ;) , but here is something very similar: img src=http://slashdot.org/my/logout; height=1

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- Octavian Rasnita [EMAIL PROTECTED] wrote: Why is so important if Internet Explorer allows URLS of images where the file name is only .jpg, .png, or .gif? A url can be something like: http://www.site.com/script.php/image.jpg?logout=true This is definitely true, but as I mentionde in a

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- [EMAIL PROTECTED] wrote: Upon your suggestion, I used a sniffer to sniff traffic for the web app that I am working on. To my surprise, the data captured during the sniff for both browsers was exactly the same. Can you elaborate or post the exact requests sent from each browser? I'm

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Saqib . N . Ali
: [PHP] CSRF attack not possible in I.E. 6.01 SP1? * Thus wrote [EMAIL PROTECTED]: Hello Chris, I can't share the exact code ;) , but here is something very similar: img src=http://slashdot.org/my/logout; height=1 width=1 If I load a web page with the above code, it should log me out

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Curt Zirzow
* Thus wrote [EMAIL PROTECTED]: Hello Chris, I can't share the exact code ;) , but here is something very similar: img src=http://slashdot.org/my/logout; height=1 width=1 If I load a web page with the above code, it should log me out of slashdot. It works in Mozilla (and netscape), but

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Ed Lazor
-Original Message- So now I am completely clueless as to why this particular attacks works in Mozilla but not in IE. Could you describe the problem again and give full detail? I think we need to better model the problem in order to present a more effective solution. The link below

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Saqib . N . Ali
[EMAIL PROTECTED] No Phone Info Available 08/16/2004 02:26 PM To [EMAIL PROTECTED] cc Subject RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? -Original Message- So now I am completely clueless as to why this particular attacks works in Mozilla but not in IE. Could you describe

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- [EMAIL PROTECTED] wrote: Hello Curt, Yes, the /. system depends on cookies to keep the user logged in. However a CSRF attack is NOT trying to access a third party cookie. The web browser make the same GET request whether it is using img/ TAG or the user clicking on a link. So in

Re: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- Curt Zirzow [EMAIL PROTECTED] wrote: I'm not sure how the /. logout system works, but my guess is that they rely on cookies to do this. Since that is a different site than from the originating file, those cookies would be considered third party. I know in IE you can disable third party

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- Ed Lazor [EMAIL PROTECTED] wrote: The link below goes to a page I found that describes CSRF a little differently than what Chris was presenting - to give a different perspective on things. http://www.squarefree.com/securitytips/web-developers.html It doesn't seem to be different,

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Chris Shiflett
--- [EMAIL PROTECTED] wrote: To give some details: I am unable to re-produce a CSRF attack when the victim is using a I.E. 6.01 SP1 (all patches applied). However the attack works in Mozilla and other older browsers. I can't give you the exact code for attack (for security reasons), but

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Ed Lazor
I was able to confirm / reproduce what you're experiencing. I was also able to confirm that toggling IE 6's acceptance of 3rd party cookies changes the behavior. Create an HTML on your local machine with the following line: img src=http://www.atfantasy.com/test/image_status.php; It'll load an

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Ed Lazor
-Original Message- However a CSRF attack is NOT trying to access a third party cookie. The web browser make the same GET request whether it is using img/ TAG or the user clicking on a link. So in either case the cookies are in the context of the website to which the cookies belong.

RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?

2004-08-16 Thread Saqib . N . Ali
/2004 04:57 PM To [EMAIL PROTECTED], [EMAIL PROTECTED] cc [EMAIL PROTECTED] Subject RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? -Original Message- However a CSRF attack is NOT trying to access a third party cookie. The web browser make the same GET request whether

[PHP] Self Testing PHP Code... Is it possible or practical??

2004-05-27 Thread Adam Reiswig
Hello all. I have been reading much lately about the wonders of writing self testing code for java, perl and others. Is this a feasible task to accomplish in PHP? I have googled every search I can think of and there just does not appear to be any information regarding self testing php out

Re: [PHP] Self Testing PHP Code... Is it possible or practical??

2004-05-27 Thread Greg Donald
Hello all. I have been reading much lately about the wonders of writing self testing code for java, perl and others. Is this a feasible task to accomplish in PHP? I have googled every search I can think of and there just does not appear to be any information regarding self testing php out

[PHP] page design and possible conflict??

2004-04-08 Thread Andy B
hi.. this might be sort of ot and out of the range of the list but i had a site design question: is it an absolute no no to put inset borders 3px wide around EVERY table on the section of the site?? im trying to make an attempt at making the site have some sort of layout standards and that happen

Re: [PHP] page design and possible conflict??

2004-04-08 Thread Andy B
dont know what his deal is but ok will close this idea now i guess.. - Original Message - From: Miles Thompson [EMAIL PROTECTED] To: Andy B [EMAIL PROTECTED] Sent: Thursday, April 08, 2004 7:41 AM Subject: Re: [PHP] page design and possible conflict?? You're right, ot out of range

Re: [PHP] page design and possible conflict??

2004-04-08 Thread Red Wingate
ok Am Donnerstag, 8. April 2004 14:45 schrieb Andy B: dont know what his deal is but ok will close this idea now i guess.. - Original Message - From: Miles Thompson [EMAIL PROTECTED] To: Andy B [EMAIL PROTECTED] Sent: Thursday, April 08, 2004 7:41 AM Subject: Re: [PHP] page design

RE: [PHP] page design and possible conflict??

2004-04-08 Thread Jason Sheets
To: [EMAIL PROTECTED] Subject: [PHP] page design and possible conflict?? hi.. this might be sort of ot and out of the range of the list but i had a site design question: is it an absolute no no to put inset borders 3px wide around EVERY table on the section of the site?? im trying to make an attempt

Re: [PHP] mkdir and rmdir possible but not readdir and opendir???

2004-02-29 Thread raisinlove
The work-around is to create the directory outside of your web application from your regular account. Or if you are allowed to run cgi scripts and these are set up via cgiwrapper or suExec to run as your own user id, use this to create the directory. Once created with the right owner, you can

[PHP] mkdir and rmdir possible but not readdir and opendir???

2004-02-28 Thread raisinlove
Hi, I'm having trouble understanding why I can create and delete directories with my script via mkdir and rmdir, but not simply being able to read them with opendir or readdir? For example, when I attempt to access these directories with opendir, I get this error message: Warning: opendir():

[PHP] mkdir and rmdir possible but not readdir and opendir???

2004-02-28 Thread raisinlove
Hi, I'm having trouble understanding why I can create and delete directories with my script via mkdir and rmdir, but not simply being able to read them with opendir or readdir? For example, when I attempt to access these directories with opendir, I get this error message: Warning: opendir():

  1   2   >