lflzkq
Last Updated: February 25, 2016
·
1.209K
· r3dsm0k3

PHP - strcmp() could leave you alone in deep sh*t

If you are using strcmp() to compare two strings,things can go real bad.
Always use === instead.

<?php 
    $pass = isset($_GET['pass']) ? $_GET['pass'] : '';
    // Query /?pass[]= will authorize user
    //strcmp and strcasecmp both are prone to this hack
    if ( strcasecmp( $pass, '123456' ) == 0 ){
       echo 'You successfully logged in.';
    }
?>
Say Thanks
Respond

1 Response
Add your response

6945
736212 10200976756252420 836055407 o

been there got the t-shirt.

over 1 year ago ·