<![CDATA[Dev1 Galaxy Forum / Username Sanitisation]]> https://dev1galaxy.org/viewtopic.php?id=7641 Fri, 05 Dec 2025 14:27:12 +0000 FluxBB <![CDATA[Re: Username Sanitisation]]> https://dev1galaxy.org/viewtopic.php?pid=60396#p60396 Pretty sure you could insert comment blocks /**/ instead of relying on spaces as separators. So disabling spaces might not make much difference, in the grand scheme of things, though in my opinion, they should be disallowed.

I had a look for known CVEs and only found an earlier SQL injection, relating to a different script, but admittedly didn't look very hard...

]]> Fri, 05 Dec 2025 14:27:12 +0000 https://dev1galaxy.org/viewtopic.php?pid=60396#p60396 <![CDATA[Re: Username Sanitisation]]> https://dev1galaxy.org/viewtopic.php?pid=60380#p60380 I wasn't planning to try anything because i was worried about being flagged and/or ip banned,especially if leaving in whitespace was intentional and there were safety measures in place.

But that doesn't seem to be the case (due to how you replied) , so I'm going to poke and see if i succeed at anything, and if i succeed or find anything noteworthy I'll send a mail to you, golinux and fsmithred.

And i don't want to ruin this place, it's nice.

]]> Thu, 04 Dec 2025 21:21:22 +0000 https://dev1galaxy.org/viewtopic.php?pid=60380#p60380 <![CDATA[Re: Username Sanitisation]]> https://dev1galaxy.org/viewtopic.php?pid=60363#p60363 When you try it, please don't do something destructive in case you succeed.

]]> Thu, 04 Dec 2025 01:36:26 +0000 https://dev1galaxy.org/viewtopic.php?pid=60363#p60363 <![CDATA[Username Sanitisation]]> https://dev1galaxy.org/viewtopic.php?pid=60359#p60359 TL;DR
Is the site (https://dev1galaxy.org) vulnerable to sql injection via the username field (register and login) due to allowing whitespace (check my name)?

LONG
Seached the forum quickly and found nothing on this. Referencing TL;DR, since most sites i see,don't allow whitespace and people use _  and

- instead. I'm not someone that has skills myself but i learn about cyber security for the sake of general knowledge. The reason i'm writing this is

for personal peace of mind, not to say anyone's incompetent since there's anti-bot measures and such, but if this was an oversight then i'd rather say something

than not. Else thank you for the constant maintainance of the site. Also if you maintain Devuan.org, thanx for the lack of cookies and JS.

]]> Thu, 04 Dec 2025 00:54:19 +0000 https://dev1galaxy.org/viewtopic.php?pid=60359#p60359