Who's Online - Strange Links

Occasionally when I look at Who's Online, i see page links like these:

/index.php?main_page=product_info&=-1%27
/index.php?main_page=product_info&...

Does anyone know what the purpose of this would be?

Thanks in Advance

~D

Those are not normal, and are not part of typical customer activity.

I see those exact ones often.

Curious if it's something to worry about.

The IP's are typically over seas.

Whoever's doing that is trying to probe for database SQL injection problems by passing parameters which could be used to trick the database into providing unauthorized information or even to change database contents.

But Zen Cart sanitizes against those kinds of things out-of-the-box.

If you're using the current version of Zen Cart and haven't added code which changes how database operations work or how data inputs are sanitized and URLs are manipulated, then you should be fine.

Still, I'd probably be inclined to block anyone doing that.

Thanks DR. B !!

The new one I see has 'A=0 rather than the 1%27.

xandros2000:

The new one I see has 'A=0 rather than the 1%27.

Basically the same thing as previously described. It is to accomplish the same goal. Ie, cause an error by the system stating that A=0 is false. As dr. Byte indeicated ZC out of the box handles this fine. Ifnot done already, be sure that any plugins associated are up-to-date. It is possible that older versions allow such statements to be a problem.

mc12345678:

A=0 is false
Although not really important, A=0 equates to True.
This is a very old trick that was often used to effectively bypass Username/password logins (which would typically return a "false" If they didn't match).
By inserting something like A=0; would make the response return a "true" no matter what username/password was supplied.
The variable "A" and the value "0" are arbitrary.
B=666; is just as effective.

This is why it is important that all inputs are (or should be) "sanitised" before use (as zencart does)

Cheers
RodG