I recently found out about shell injection and I have codes that executes user inputs in shell environment I need to sanitize the input so that there is no backticks or other malicious strings. Is it enough to use str_replace() and remove them?
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
Cardinality of separable metric spaces Combinatorial argument to prove the recurrence relation for number of derangements Give a combinatorial argument to prove that the number of derangements satisfies the following relation: $$d_n = (n − 1)(d_{n−1} + d_{n−2})$$ for $n \geq 2$.  I am able to prove this algebraically but not able to see the combinatorial example. Suppose one is trying to find the radius of convergence of  $$ \exp(x)=\sum\limits_{k=0}^{\infty} \frac{x^k}{k!} $$  This "proof" was given in the lecture: $$ \begin{align} r =&amp; \frac{1}{\limsup\limits_{n \rightarrow \infty}\sqrt [n]{|a_n|}} \\ =&amp; \frac{1}{\limsup\limits_{n \rightarrow \infty}\sqrt [n]{\frac{1}{n!}}} \\ =&amp;\lim\limits_{n \rightarrow \infty} \sqrt [n]{n!}\\ r=&amp; \infty \end{align}$$  Other proofs involving the ratio test also seem to inspect the convergence of $\frac{1}{k!}$ instead of $\frac{x^k}{k!}$. Why is one allowed to substitute $\frac{1}{k!}$? Has anyone successfully deleted the Windows Installer files successfully before? They are taking up 35.1% of my total hard drive space.  Which ones are needed and which ones can be purged?  In order to see this folder, I had to unhide system files by going to Windows Explorer > Organize (dropdown) > Folder and Search Options > view tab > uncheck ==> Hide protected operating system files (Recommended).  I used WinDirStat program to get these percentages. To see the image in full size, open it in a new tab.  I was told by someone that you should not delete these files, but then I found a utility--Windows Installer CleanUp Utility (very old version) that deleted these.  But it doesn't run on Windows 7.  If anyone has a later version that they found works, please let me know the path. How to completely remove Notepad++ in Ubuntu 18.04 terminal?  I can't find it in Synaptic package manager, and don't know where is on system, but I can see an icon in Activity. It is probably not completely installed, because I can't open it. Word for two collections that do not have any elements in common I'm looking for a word for when you have a collection A and a collection B and they have no overlap.  In mathematical terms: the relation between two sets where the intersection is empty. Like in this Venn diagram:    The word that keeps popping up in my mind is disparate sets, but I don't feel that completely covers the meaning when I look at the definition, because that doesn't seem to preclude overlapping sets that are different:     disparate   1. distinct in kind; essentially different; dissimilar:   disparate ideas. Why is feed-forward mechanism used in hash functions? The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, the previous block's output (as specified by Merkle-Damgård) is used. These values are fed to the last round of the compression function.  Why would removing the feed-forward part (i.e.,the final step where the input value is added to the result to get the final output) make the hash function insecure? Apart from the fact that the compression function would not satisfy desired randomness properties (being a permutation for each fixed message). How do I change the shortcut-key of show the unity dash? I don't want to use the Super for that, I want to use Alt+Space instead. Can $\sqrt{n} + \sqrt{m}$ be rational if neither $n,m$ are perfect squares? Wasted screen space due to multiple horizontal bars at the top when an application is open in GNOME desktop Parenthetical pluralization of words ending in '-y' Finder search doesn't work properly after Yosemite update Ever since I upgraded to Yosemite, search no longer works properly in Finder. Spotlight works fine but Finder search just gives me a blank window with a spinning ball.  I've tried reindexing and I've also tried deleting Spotlight's .plist file. I restart my MacBook Pro after doing either. Finder search will work for one or two queries and stop again. I don't know what else I can do. Explanation of C++ FAQ's unsafe macro? Android How to use MediaScannerConnection scanFile Selecting points within polygon and updating attributes using ArcPy? I have two feature classes, a polygon of sales areas for a city, and point layer of addresses. I want to select the addresses based on the sales area they are in and update their attribute table to show the sales area. I have searched python+point+in+polygon for other posts and I know how to select the polygons but I can't figure out how to populate the address points.   I found the following script that works but takes almost two hours to run.  import arcpy import os  # Allow overwrite  arcpy.env.overwriteOutput = True  # Script user input parameters polygonLayer = arcpy.GetParameter(0) pointLayer = arcpy.GetParameter(1) workspace = arcpy.GetParameter(2) copyField = = arcpy.GetParameterAsText (3)   # Add new field to target feature class  fieldList = arcpy.ListFields(pointLayer) fieldNameList = [] for field in fieldList:    fieldNameList.append(field.name) fieldType = arcpy.ListFields(polygonLayer,copyField)[0].type if not copyField in fieldNameList:     arcpy.AddField_management(pointLayer, copyField, fieldType)  arcpy.MakeFeatureLayer_management(polygonLayer, "PolygonLayer")  pntCursor = arcpy.UpdateCursor(pointLayer) for pnt in pntCursor:     rowID = pnt.OBJECTID     arcpy.MakeFeatureLayer_management(pointLayer, "PointLayer", '"OBJECTID" = ' + str(rowID))      # Polygon selection based on CONTAINS selection method     arcpy.SelectLayerByLocation_management("PolygonLayer", "CONTAINS", "PointLayer")      # Copy field values from polygon to point layer         polyCursor = arcpy.SearchCursor("PolygonLayer")             for poly in polyCursor:         pnt.setValue(copyField, poly.getValue(copyField))         pntCursor.updateRow(pnt)      arcpy.Delete_management("PointLayer")          del pntCursor, polyCursor, pnt, poly   I don't think I need to create a new field so I have simplified my script too:  # Import arcpy module import arcpy import os  # Allow overwrite  arcpy.env.overwriteOutput = True  # Script user input parameters polygonLayer = arcpy.GetParameter(0) pointLayer = arcpy.GetParameter(1) workspace = arcpy.GetParameter(2) fsaPoly = arcpy.GetParameterAsText (3) #FSA in FSA_Boundaries fsaPnt =  arcpy.GetParameterAsText (4) #FSA in Addresses   # Select all Address in FSA     polyCursor = arcpy.SearchCursor("PolygonLayer")      for poly in polyCursor: # Select based on CONTAINS      arcpy.SelectLayerByLocation_management(poly, "CONTAINS", "PointLayer")  # Add FSA to Address         pntCursor = arcpy.UpdateCursor("pointLayer")               for pnt in pointCursor:             pnt.setValue(fsaPnt, fsaPoly)             pntCursor.updateRow(pnt)   del pntCursor, polyCursor, pnt, poly   I know my update cursor is wrong but i'm stuck on how to update one feature class using information selected from the other.   I know I can do this manually but I need to do it for multiple cities so I would like to automate the process.   I am using Arc 10.2.2 to run my python script. Highlight text in code listing while also keeping syntax highlighting I’m using the listings package for code listings. Now I try to highlight some part of the code using \hl from the soul package.  Here’s an example of a resulting query where the injected part of a SQL injection should be highlighted:  \begin{lstlisting}[escapechar=@,language=SQL] SELECT name, password FROM users WHERE name='@\hl{' UNION SELECT "10", 1 \#}@'; \end{lstlisting}   But inside the highlighted part the SQL syntax highlighting is not applied.  So I tried to use \lstlinline for the code part inside \hl as well but it didn’t work:  \begin{lstlisting}[escapechar=@,language=SQL] SELECT name, password FROM users WHERE name='@\hl{\lstinline[language=SQL]$' UNION SELECT "10", 1 #$}@'; \end{lstlisting}   Although this \lstinline part works outside the lstlisting block, it doesn’t work inside it. The error I get for that particular line is:     Extra }, or forgotten \endgroup.   Maybe I’m just missing just some special syntax to get this working. Or is it not possible at all to get proper syntax highlighting for the \hl-highlighted part as well? Where do I put the code snippets I found here or somewhere else on the web? Many posts here or somewhere else contain code, but they do not say where to put it.  Example:  I have found this post:  I'm a newbie with PHP. Where exactly should I place the code from the answer? For a given ellipse, find the locus of all points P for which the two tangents are perpendicular.   I have a trigonometric proof that the locus is a circle, but I'd like a pure (synthetic) geometry proof. Occasionally I see an old Meta post that has no status tag (like ), but from the answers it looks like the question is resolved.  Example:  should be  since the answers say HTTP compression actually is enabled.  Is it worth flagging these questions, or is that a waste of time? Call marker color in Geojson to apply to leaflet.js in php