News for hackers. Stuff that matters.

A comment on SQL Injecting PhpMyAdmin. Parent comment

Re: SQL Injecting PhpMyAdmin by gaika on Wednesday June 04, 2008 @07:47PM (#209495)
That's not a solution. You can read more about XSRF and how to protect against it: http://en.wikipedia.org/wiki/Cross-site_request_forgery
[ Parent | on HN ]
Re: SQL Injecting PhpMyAdmin by nilobject on Wednesday June 04, 2008 @07:57PM (#209503)
I have my phpMyAdmin installed only on my secure site, behind HTTP authentication as well.
[ Parent | on HN ]
Re: SQL Injecting PhpMyAdmin by rcoder on Wednesday June 04, 2008 @09:32PM (#209551)
If you're using HTTP Basic auth, your browser will happily cache the credentials and re-submit them every time when asked for the same server/realm combination. You'll need to restart your browser to clear the cached auth data.
[ Parent | on HN ]
Re: SQL Injecting PhpMyAdmin by simonw on Thursday June 05, 2008 @03:45AM (#209740)
The reason CSRF is scary is that it works against those defences.
[ Parent | on HN ]