[Slacker]

Ok I am wanting to learn for educational purposes, There is one site i want to play around and test this on but it is ran by my self. If any one is willing to teach me how to exploit weaknesses in a site it is greatly appreciated. I am wanting to learn incase my site is ever takin down when we get it up and running, like what to look for and what to make sure is not a vulnerable weakness
I am fairly educated and catch onto shit fairly quick so there wouldnt be any need to repeat your self over and over to me.

[i0xIllusi0n]

If your website uses SQL, make sure you protect from SQL Injection, which you can do from PHP.
Prevent XSS, which you can also do from PHP.

If you have a login, hash your passwords. (More hashes in an algorithm = better security)
If you have a login, add a function to deny access if they have too many requests in a short amoutn of time (to stop brute force)
If you store cookies, encrypt the cookies and hook it with something, (like IP) to stop cookie stealing.
Have an Anti-flood script.

[Slacker]

ok but how do i do this stuff lol
Also wanting to learn and try on my site, strictly for educational purposes of course (legal disclaimer lol)

[i0xIllusi0n]

Well here's a sanitize function...

Code:

function sanitize($sql, $formUse = true)
{
    $sql = preg_replace("/(from|order by|concat|group_concat|src|select|insert|delete|where|drop table|show tables|,|<|>|'|#|\*|--|\\\\)/i","",$sql);
    $sql = trim($sql);
    $sql = strip_tags($sql);
    if(!$formUse || !get_magic_quotes_gpc())
    {
        $sql = addslashes($sql);
    }
    return $sql;
}

To hash your passwords, you can use MD5. md5($data);
Anti-flood would prevent brute force, if you use it right. There's a thread on here with an anti-flood script. Could use that.
To encrypt cookies, you can use Base64 or other encoding methods to do that. Make sure it's with a salt though, or anybody can decrypt.

[w00t]

http://php.net/manual/en/mysqli.real-escape-string.php

There's a function for sanitation.

[Slacker]

Thanks guys. Hopefully I will be able to get someone on join.me or TeamViewer or w/e to help. That would be dope!