Direct Dynamic Code Evaluation ('Eval Injection') - Revision history

Alan Jex: Added attack to Injection subcategory

2011-12-06T22:07:23Z

Added attack to Injection subcategory

2009-05-27T18:31:20Z

Reverting to last version not containing links to www.textbascaliget.com

2009-05-27T16:00:30Z

Reverting to last version not containing links to s1.shard.jp

2009-05-26T12:10:04Z

2009-05-22T20:20:22Z

2009-04-07T12:40:03Z

2009-02-15T13:05:36Z

2008-09-14T12:06:21Z

2008-09-14T12:06:00Z

2008-09-14T12:01:52Z

@@ Line 160: / Line 160: @@
 * http://en.wikipedia.org/wiki/Code_injection
-[[Category:FIXME|needs subcategory]]
+[[Category:Injection]]
 [[Category: Attack]]
 __NOTOC__

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
@@ Line 111: / Line 110: @@
 ===Example 6===
-The following code is  vulnerable to eval() injection, because it donât sanitize the userâs input (in this case: âusernameâ). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
+The following code is  vulnerable to eval() injection, because it don’t sanitize the user’s input (in this case: “username”). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
 Example:

@@ Line 1: / Line 1: @@
 http://www.textbascaliget.com
 {{Template:Attack}}
@@ Line 148: / Line 111: @@
 ===Example 6===
-The following code is  vulnerable to eval() injection, because it donÃ¢ÂÂt sanitize the userÃ¢ÂÂs input (in this case: Ã¢ÂÂusernameÃ¢ÂÂ). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
+The following code is  vulnerable to eval() injection, because it donât sanitize the userâs input (in this case: âusernameâ). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
 Example:

@@ Line 1: / Line 1: @@
 http://www.textbascaliget.com
 {{Template:Attack}}
@@ Line 111: / Line 148: @@
 ===Example 6===
-The following code is  vulnerable to eval() injection, because it donât sanitize the userâs input (in this case: âusernameâ). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
+The following code is  vulnerable to eval() injection, because it donÃ¢ÂÂt sanitize the userÃ¢ÂÂs input (in this case: Ã¢ÂÂusernameÃ¢ÂÂ). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
 Example:

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
@@ Line 110: / Line 111: @@
 ===Example 6===
-The following code is  vulnerable to eval() injection, because it don’t sanitize the user’s input (in this case: “username”). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
+The following code is  vulnerable to eval() injection, because it donât sanitize the userâs input (in this case: âusernameâ). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
 Example:

@@ Line 3: / Line 3: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]
 Last revision: '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 151: / Line 151: @@
 ==Related [[Vulnerabilities]]==
-* [[:Category:Input_Validation_Vulnerability]]
+* [[:Category:Input Validation Vulnerability]]
 ==Related [[Controls]]==