   [web] Hack-proof my site?
  I'm wondering what tool I can use to modify my post variables, the same way a hacker would, so I can test various modifications to the post vars and make sure I'm conditioning the inputs appropriately.  For instance, I would like to change one of my post vars to "'; something" to see if my code properly eliminates that possibility.Any links, or ideas?   
Quote:Original post by ID MerlinI'm wondering what tool I can use to modify my post variables, the same way a hacker would, so I can test various modifications to the post vars and make sure I'm conditioning the inputs appropriately.  For instance, I would like to change one of my post vars to "'; something" to see if my code properly eliminates that possibility.Any links, or ideas?Just for you know you can't put PHP in post vars. I believe the only problem is the MySQL injection. To fix that all you do is backslash all their input before send to database.   ;  You can't simply validate all fields according to the same rules. There are things like mod_security which scan query strings or post payloads for undesirable content, but they suffer badly from false positives.To secure your server-side application, you should take a holistic approach- i.e. it needs to be designed in such a way that (e.g.) SQL injections and XSS vulnerabilities CANNOT happen.Unfortunately most web applications aren't.Normally the problems are SQL injection and HTML injection (leading to XSS vulnerability). These are (relatively) easily solved by using parameterised queries and a templating system throughout (which automatically escapes HTML output, or allows you to audit it easily at least).Just doing things in an ad-hoc manner will result in a very poor application.There are of course other issues as well, such as programming errors or design mistakes. CSRF is also an important thing to try to guard against, especially if you're making an application where the source code is available.Depending on the amount of attacks you expect, it may be a good idea to place rate-limiting on various things - mod_security or mod_evasive may help here (but tune them very carefully to prevent denial to legitimate users). Limit logon attempts and sign ups by IP and time. Make things difficult for authors of "bad robots".Mark   ;Quote:Original post by ID MerlinI'm wondering what tool I can use to modify my post variables, the same way a hacker wouldSimply create a HTML file with a method="post" form on your desktop and set the action attribute to your website.;Quote:Original post by SanderQuote:Original post by ID MerlinI'm wondering what tool I can use to modify my post variables, the same way a hacker wouldSimply create a HTML file with a method="post" form on your desktop and set the action attribute to your website.D'oh!  I'm glad I asked, as that will be so simple.