Lowyat.NET: Latest topics by angch

Advent of Code 2021

angch — Thu, 02 Dec 2021 12:09:29 +0800

https://adventofcode.com/

Christmas-themed computer programming challenges that follow an Advent calendar and can be solved using any programming language.

Day 2 soon.

PM me if anyone wanna join my private leaderboard. https://adventofcode.com/2021/leaderboard/private

I've posted by solution for yesterday's puzzle here:

https://github.com/angch/adventofcode/tree/...r/angch/2021-01

Some of us discuss the solutions and puzzles over at the #code channel on https://engineersmy.slack.com (invites via https://engineers.my/ ) I'll stream/record my attempts whenever I can.

New day, new challenge begins everyday until 25th December, at our lunch time, 1PM.

Good luck, have fun.

Windows Portable Executable files as a unix script

angch — Mon, 24 Aug 2020 11:03:10 +0800

QUOTE

it's possible to encode Windows Portable Executable files as a UNIX Sixth Edition shell script, due to the fact that the Thompson Shell didn't use a shebang line. Once I realized it's possible to create a synthesis of the binary formats being used by Unix, Windows, and MacOS, I couldn't resist the temptation of making it a reality, since it means that high-performance native code can be almost as pain-free as web apps. Here's how it works:

CODE

MZqFpD='
BIOS BOOT SECTOR'
exec 7<> $(command -v $0)
printf '\177ELF...LINKER-ENCODED-FREEBSD-HEADER' >&7
exec "$0" "$@"
exec qemu-x86_64 "$0" "$@"
exit 1
REAL MODE...
ELF SEGMENTS...
OPENBSD NOTE...
MACHO HEADERS...
CODE AND DATA...
ZIP DIRECTORY..

https://justine.storage.googleapis.com/ape.html

https://github.com/jart/cosmopolitan

Go wild, @Tullamarine.

Quote. Your. Damn. SQL. Inputs!

angch — Mon, 09 Mar 2015 13:26:09 +0800

https://forum.lowyat.net/topic/3398408

Yes, I'm talking about you, https://forum.lowyat.net/topic/3517025

Quote your damn SQL inputs!

angch — Mon, 03 Nov 2014 20:26:57 +0800

Sigh, have enough of seeing bad code passing by here, and people replying and fixing the wrong (IMHO) things. Topic is closed, so didn't manage to post proper reply to the original post.

Read these:

http://en.wikipedia.org/wiki/SQL_injection

http://php.net/manual/en/mysqli-stmt.bind-param.php

http://php.net/manual/en/security.database.sql-injection.php

TL/DR:

Don't do this:

CODE

$mysqli->query("UPDATE table Foo set body= '".$_POST['body']."' where id= '".$_POST['id']."'");

Do this (well, a *better* version of this):

CODE

$stmt = mysqli_prepare($link, "UPDATE table Foo set body = ? where id= ?");
mysqli_stmt_bind_param($stmt, 'sd', $_POST['body'], $_POST['id']);
mysqli_stmt_execute($stmt);