Making A Loader

@Azuki I would consider that doing some php forms to interact with your database would be by itself an high protection. It would be one of the best ways to implement an online login system in an application. If you directly let your application communicate with the database, I would take less than 60 seconds to get your essentials database username and password.
Doing an interface between database and php, and then an interface between PHP and C# is enough. If someone gets the link of your php forms by using a sniffer, he can't do so much -> there are some of countermeasures ... checking the useragent, limiting requests.

I have doubts about you know what spoofing is. You can spoof it, but how do you get the UserAgent? Which SQL statement are you talking about? Please, can you have the effort to elaborate?

And, just to say, SSL is also vulnerable to the heartbleed bug

A simple UserAgent with a checker is probably breakable by reversing the program or using a sniffer, this is what you didn't say.

Everything sould be made as simple as possible, but not simpler

Because it's obvious I can use a custom UserAgent. Maybe you were trying to say how to get the UserAgent that will be set on the website?


I'm not sure how you are interpreting what I wrote. Don't invent strange things, I was quoting this:



which sql statement were you referring to? Do you know what were you talking about?



Wow, seriously? How did you _mind_ I didn't know how to check the UserAgent of an user which is browsing my website? Why are you strutting about this?


Saying you can spoof an UserAgent is like saying it's _possible_ to use a custom UserAgent, it is superfluous and pointless. Saying you can get the right UserAgent which validates your request to the webserver has more sense.


Many websites still use an old version of OpenSSL, so it's still relevant.


Who did ask it?


Because the implementation will be muddler and conventionally wrong. You can customize your UserAgent, why shouldn't you do it?


What am I re-inventing?


Till this year, it is relevant. Maybe in 10 years it won't, but it is still relevant. You probably don't have any conception of this.



1. PHPIDS is not maintained since 4 years.
2. PHPIDS is vulnerable to XSS, LFI, IP spoofing, and mostly to CRLF injection attack, look at point 1.

At least, if you want to use something like PHPIDS, look at the forked versions.

Summarizing, you are suggesting glaring and bad methods to do the work, and this citation:



would lose its meaning.

Don't tell me to hide a pen you put it into a strongbox.

- - - Updated - - -

Limiting requests for a bunch of time is better and clearer as I've already said. Mostly I would consider doing an UserAgent checker if you want to make it more secure.

p.s: Obviously you should consider this:

as a jargon. I mean that who uses that old OpenSSL as implementation is vulnerable.

Don't tell me to hide a pen you put it into a strongbox