Error in /article_view.php:

[administrator]

I am still running aeDating 4.1 on some of my dating sites and here is an unfriendly reminder from a spammer that the data isn't filtered as well as it ought to be:

Error in /article_view.php: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server
version for the right syntax to use near '://www.cjp.spb.ru/en/tis/leboma/' at line 1
Query: 'SELECT * FROM `Articles` WHERE `ID` =

 Content visible to registered members only. Please Click Here To Register

'

This is probably an injection attack candidate as well because it can be accessed directly by a badguy.

One way to fix it is to add a filter trap like the following:

Find in article_views the line:

$article_arr = db_arr( "SELECT * FROM `Articles` WHERE `ID` = $article" );


Just before it add:


if ( !empty( $_GET['article'] ))
{

$pattern ="/(http:\/\/|ftp:\/\/|https:\/\/|www|\[url=)[^\s]+\.(com|co|org|net|info|gov|biz|[a-z]{2}|[a-z]{4}|[a-z]{3})(\.[a-z]{2})*(\/[a-zA-Z0-9]*)*|select|insert|update|delete|drop|alter|create /";

if ( preg_match($pattern, $_GET['article']))
{
mail("your@email.com"," ***** Hacker-Spammer-Scraper Attempt ***** ", " From IP address : " . $_SERVER['REMOTE_ADDR'] . " User Agent: " . $_SERVER['HTTP_USER_AGENT'] . " on the file: " . $_SERVER["SCRIPT_NAME"]);
exit("add your greeting for the spammer");

}
}



This MOD will reject any attempt to add a link to the article_view reqest form. It also sends you an email with the badguy's IP address and information about the browser he was using to submit the bad request so you can add the badguy to your blocklist if you have one.

In addition, the pattern test will block submissions requesting a basic set of SQL commands to help prevent an SQL injection attack.

You could use this same code to filter input from almost any input form on aeDating or some variation of it. Notice that this is a $_GET request. This block would work on $_POST requests as well.


Enjoy!