Tag Info

Hot answers tagged

4

Short answer: The password check via the if statement is not sufficient. With the SQL injection and access to the source of your authentication script, they have everything they need for full access. Long answer: We've already established that your auth script is vulnerable to SQL injection. You also describe the code as very old and unchanged. From this ...


1

Those options are to manage what IP will the server use to listen for the incoming connections. I would recommend that you use Ubuntu firewall to controll who has access to the ES port, or you can use a plugin from Elastic, Shield, that provides that feature (as described in Shield documentation.


1

mysqli and PDO both operate in buffered mode by default. This means that your queries are effectively subject to the PHP process memory limit. From http://php.net/manual/en/mysqlinfo.concepts.buffering.php: [In buffered mode], query results are immediately transferred from the MySQL Server to PHP and are then kept in the memory of the PHP process. ...



Only top voted, non community-wiki answers of a minimum length are eligible