Table prefix in PHP Nuke…

August 18, 2006 6:14 pm by Markus.

Ever tried to install some PHP app for your website? Especially the ones that come with a sql-schema file that you need to run through MySQL? What I wonder about is that many of these applications - PHPNuke for example - support prefixing table names. Having non-standard table names can be helpful in making SQL-injection attacks more difficult. Not impossible, mind you, it just adds another layer of obscurity - but of the shelf script-kiddie exploits won’t work anymore. And yet editing such a schema file is a pain for administrators. Which explains why people rarely do it…

Anyway… Here’s my perl one-liner for changing the schema files table names prefix for PHP Nuke:

perl -i -pe ’s/(TABLE|INTO) (nuke_)/$1 qqq$2/g’ nuke.sql

This will change the default prefix “nuke” to “qqqnuke” in the schema file. Then you change the prefix in the config.php file accordingly (change $prefix and $user_prefix). Done…

Posted in Security | Print | No Comments »