- Markus Breitenbach - http://blog.markus-breitenbach.com -

Table prefix in PHP Nuke…

Posted By Markus On August 18, 2006 6:14 pm @ 6:14 pm (August 18, 2006) In Security | No Comments

Ever tried to install some PHP app for your website? Especially the ones that come with a sql-schema file that you need to run through MySQL? What I wonder about is that many of these applications - PHPNuke for example - support prefixing table names. Having non-standard table names can be helpful in making SQL-injection attacks more difficult. Not impossible, mind you, it just adds another layer of obscurity - but of the shelf script-kiddie exploits won’t work anymore. And yet editing such a schema file is a pain for administrators. Which explains why people rarely do it…

Anyway… Here’s my perl one-liner for changing the schema files table names prefix for PHP Nuke:

perl -i -pe ’s/(TABLE|INTO) (nuke_)/$1 qqq$2/g’ nuke.sql

This will change the default prefix “nuke” to “qqqnuke” in the schema file. Then you change the prefix in the config.php file accordingly (change $prefix and $user_prefix). Done…


Article printed from Markus Breitenbach: http://blog.markus-breitenbach.com

URL to article: http://blog.markus-breitenbach.com/2006/08/18/hello-world/

Click here to print.