Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>One clever solution to this that I've seen is to include a "honeypot" input box and set its CSS display value to none. If there is anything in that box, you know it's a script. Also, use something really obscure for the real name of the field, and pass in a token you can validate upon submission. For example:</p> <pre><code>&lt;input type="text" name="zsdifhs" value="&lt;?= $q ?&gt;" id="zsdifhs" /&gt; &lt;input type="text" name="q" value="&lt;?= $tok ?&gt;" id="query" style="display:none;" /&gt; </code></pre> <p>Or possibly set it to the background color of your page; if that's white, something like:</p> <pre><code>&lt;input type="text" name="zsdifhs" value="&lt;?= $q ?&gt;" id="zsdifhs" /&gt; &lt;input type="text" name="q" value="&lt;?= $tok ?&gt;" id="query" style="font-size: 1pt; color: white;" /&gt; </code></pre> <p>Or set it to some non-visible margin, like:</p> <pre><code>&lt;input type="text" name="zsdifhs" value="&lt;?= $q ?&gt;" id="zsdifhs" /&gt; &lt;input type="text" name="q" value="&lt;?= $tok ?&gt;" id="query" style="margin-left: 9000px;" /&gt; </code></pre> <p>In the processing script, if <code>$_POST['q']</code> is set to anything except the token you passed in, you know it's almost certainly been modified by a script. To avoid detection, you can also use javascript to change the CSS display status, and if you're feeling really clever, you can even do something fancy like return a static page with bogus results (which is pretty efficient) instead of actually processing the query instead of returning an error or access denied page, which the script would probably detect, allowing the attacker to check to see what's wrong and tweak their script.</p>
    singulars
    1. This table or related slice is empty.
    1. POHow to detect bots spamming forms and log IPs & input?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USKing Skippus
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COwhat answer King Skippus thx you :) the code look good , if i implement your first code $_POST['q']=token passed in/out, how i can monitor the result script/bots/users ? is there a way to store a log into txt file or something ?
      singulars
      1. PO
      1. USuser1792805
    2. COWhen you generate the page, create a random token of letters and store it somewhere (like in a tokens table in your database). For example, the token for a given page load might be "Moacoaco", and you would insert that into a tokens table. Then when a form is submitted, check the submitted token to see if it exists in the tokens table. If so, delete it and continue processing the script normally. If not, then you've probably got a script running your page. At that point, I would probably return a static page of bogus results, log it, and after 10 attempts or so, start blocking the IP address.
      singulars
      1. PO
      1. USKing Skippus
    3. COi see King Skippus, even it's a good solution for now ,there is too much step to accomplish this since im not php developper , i understand but im not experienced to implement as you say , i know its not a hard thing to code but need more learning ....thx you anyway m8
      singulars
      1. PO
      1. USuser1792805
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload