Oh no! Where's the JavaScript?
Your Web browser does not have JavaScript enabled or does not support JavaScript. Please enable JavaScript on your Web browser to properly view this Web site, or upgrade to a Web browser that does support JavaScript.
Not a member yet? Click here to register.
Forgot Password?

Shoutbox last character hack

Asked Modified Viewed 2,687 times
B
bite
B
bite 10
  • Member, joined since
  • Contributed 163 posts on the community forums.
  • Started 5 threads in the forums
  • Started this discussions
asked
Member

I just found what if last character in shoutbox is & or " or ' , in some situations it will get corrupted
Message:
111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111  [color=#cc0000]*[/color]

In this case 111... is just to fill space, it can be any character except & or " or '.
Now replace * in message with & or " or ' , and see result, you can also try to add more characters to fill space, this will change cutting point of encoded character, for example:
with current filling:
' will be &#3
if we add one more 1
' will be &#
Funny eh? :D
_______
Explaining:
Message which will be inserted in to database is longer then 255 characters, because after stripinput some characters turn from one up to 6. This means what message can be up to 255*6 in length. To fix that: you must limit amount of characters in message who needs to be escaped or allow length of message in sql up to 1530.
Best solution: change shout_message field type to TEXT, this will not only fix problem, but will bring option to change shout_message length whiteout modifying sql!
Edited by bite on 05-07-2009 23:10,
0 replies
There are no post found.

Category Forum

Bugs and Errors - 6

Labels

None yet

Statistics

  • Views 0 views
  • Posts 0 posts
  • Votes 0 votes
  • Topic users 1 member

0 participants

Notifications

Track thread

You are not receiving notifications from this thread.

Related Questions

Not yet