Magic Quotes question

Hi,
I posted this earlier to webappsec@xxxxxxxxxxxxxxxxx with no luck ,
does anyone know how to bypass magic quotes? a proven working way .

example is, in such a simple SQL like
"SELECT * from USERS WHERE id =$id";

I am looking for ways to by pass magic quotes to inject this
INTO OUTFILE '/home/z.php'

point is, if magic quotes can stop this, so why is it going to be removed in php6? it can simply stay and be activated or deactivated on will.
and if there is a way to by pass, I want to include it in my check GET/POST inputs.

cheers
DokFLeed



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: Injected, whats next
    ... Tried that, and it looked promising, however got stuck with the magic quotes. ... Does anyone know a way to upload a file to a server through MySQL! ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Magic Quotes question
    ... Why wouldnt you just put the escape function inside of the database ... many modern db engines can use *any* delimiter, for any language, ... "magic quotes" was simply the wrong level to apply data filtering at. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Magic Quotes question
    ... in php6? ... for server admins and developers alike since there is no setting you ... And I experienced some configurations where Magic Quotes creates more ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Magic Quotes question
    ... is there an actual way to bypass Magic Quotes? ... CHAR doesnt work, also %% doesnt work ... Some data engines use \', others use '', others need no ' escaping, and since many modern db engines can use *any* delimiter, for any language, "magic quotes" was simply the wrong level to apply data filtering at. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Magic Quotes question
    ... Magic quotes, as well as the correct db-specific escaping functions ... in MySQL, not sure of others), which means you have to use ' or ", ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)