2 Apr
2005
2 Apr
'05
7:34 p.m.
On Thu, 31 Mar 2005, Graham Toal wrote:
PS Unfortunately there's a small bug caused by him
mishandling
protection against data injection attacks: you can't enter Algol60
code or anything else with single quotes in it :-( ...
e.g. http://www.facade.com/legacy/punchcard/?val='BEGIN'
That's inadvertent. The script parser (PHP perhaps?) is automatically
escaping the single quote with a backslash, which is the default action.
You normally have to run web inputs through filtering functions to get rid
of any escape characters the parser added.
--
Sellam Ismail Vintage Computer Festival
------------------------------------------------------------------------------
International Man of Intrigue and Danger http://www.vintage.org
[ Old computing resources for business || Buy/Sell/Trade Vintage Computers ]
[ and academia at www.VintageTech.com || at http://marketplace.vintage.org ]