[xSploit™]

Nice to see something worthwhile in this section for once. Would be cool if you had the option to run SQL commands as well as the DBAL like functions.

What's the need in authentication when it's being stored in your web folder though?

If I were you I'd be taking advantage of func_num_args() a lot more as well.

[Xerotic]

I can't help but wonder what happens when the database size becomes larger. Have you worked with a 30GB+ database with your project?

[Ego Inc]

I can't help but wonder what happens when the database size becomes larger. Have you worked with a 30GB+ database with your project?

I've worked with a 15gb+ db with it to test speeds and it worked fairly well, still have a few plans for it to speed things up tho.

[ASDA]

Good to see this kind of progress.
But how does this compare to SQLite?

http://henryranch.net/software/ease-into...p-and-pdo/

Awful, I'm assuming. I'm pretty sure it's a key:value store, whereas SQLite is RDBMS, not sure why anybody would use this over SQLite in any situation.

Also, I'm pretty sure using a NUL terminator will allow LFI. Lets say you do something like this:

PHP Code


<?php 
$shopName = someArbitraryEscapeFunction($_GET['shopName']);
get_where("{$shopName}_shop", "itemId", "1"); 


what happens if I pass in:

../../../../../../etc/passwd%00

I'll give you a clue:

root:x:0:0:root:/root:/bin/zsh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
ts3user:x:1000:1000::/home/ts3user:/bin/nologin
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/sbin/nologin
user:/var/lib/clamav:/sbin/nologin
uwsgi:x:997:995:uWSGI daemon user:/var/run/uwsgi:/sbin/nologin
dovecot:x:97:97:Dovecot IMAP server:/usr/libexec/dovecot:/sbin/nologin
dovenull:x:996:994:Dovecot's unauthorized user:/usr/libexec/dovecot:/sbin/nologin
nginx:x:995:993:Nginx web server:/var/lib/nginx:/sbin/nologin
amavis:x:994:992:User for amavisd-new:/var/spool/amavisd:/sbin/nologin
vmail:x:2000:2000::/var/vmail:/sbin/nologin
iredadmin:x:2001:2001::/home/iredadmin:/sbin/nologin
iredapd:x:2002:2002::/home/iredapd:/sbin/nologin
cluebringer:x:2003:2003::/home/cbpolicyd:/sbin/nologin
postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/nologin
mailman:x:41:41:GNU Mailing List Manager:/usr/lib/mailman:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
saslauth:x:993:76:"Saslauthd user":/run/saslauthd:/sbin/nologin
getmail:x:2004:2004::/etc/getmail:/bin/nologin
ispapps:x:2005:2006::/var/www/apps:/bin/nologin
ispconfig:x:2006:2007::/usr/local/ispconfig:/bin/nologin
web1:x:2007:2008::/var/www/clients/client0/web1:/bin/false
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
opendkim:x:992:991::/home/opendkim:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
vacation:x:991:990:Virtual vacation:/var/spool/vacation:/sbin/nologin

[Ego Inc]

Awful, I'm assuming. I'm pretty sure it's a key:value store, whereas SQLite is RDBMS, not sure why anybody would use this over SQLite in any situation.

Also, I'm pretty sure using a NUL terminator will allow LFI. Lets say you do something like this:

PHP Code


<?php 
$shopName = someArbitraryEscapeFunction($_GET['shopName']);
get_where("{$shopName}_shop", "itemId", "1"); 


what happens if I pass in:

I'll give you a clue:

It's All stored in JSON Arrays not '$ksy:$val'?

Here's an example of a small table:

Code

{"file":{"rows":{"0s":"NoSQL-v5.zip","1s":"ModNoSQL-v5.zip"},"type":"string","name":"file"},"times":{"rows":{"0":"3i","1":"4i"},"type":"int","name":"times"}}

[La Manifesto]

Awful, I'm assuming. I'm pretty sure it's a key:value store, whereas SQLite is RDBMS, not sure why anybody would use this over SQLite in any situation.

Although I would never use this Database System, you must not have any knowledge of key-value stores. NoSQL databases offer speeds faster than Relational Databases, the only major difference is, well, relationships between tables.

[Ego Inc]

Just realease a huge update.

CHANGELOG
------

###### New Features ######
[X] Stores data in ram.
[X] Can remotely connect to database.

###### Bug Fixes ######
[X] Fixed bug with 'get()' always returning the id when used with find

###### New Functions ######
[X] remote()
[X] checkRemotePrivs()
[X] remoteConnectionEnabled()
[X] nullFunction()
[X] nodeInit()
[X] settings()

---

Although I would never use this Database System, you must not have any knowledge of key-value stores. NoSQL databases offer speeds faster than Relational Databases, the only major difference is, well, relationships between tables.

Yeah the speeds are much faster for the most part.

[Ego Inc]

Could you share the code you used for your benchmarks?

I will be re-creating new benchmarks here soon as there have been a ton of changes to the system. However at the moment I am developing a forum for it (powered by PHD). When I finish that I will hit you up on skype with the new benchmarks (we are both part of the programming chat I believe).

[MineSQL]

Maybe I'll make a little site using your database, and see how it does compared to my rapid development ORM. Suggestions?

Also: GITHUB Now! Grrrr!

[Mongrel]

This really needs a Github so we can contribute.

[Ego Inc]

This really needs a Github so we can contribute.

I have one, I just need to update the source on it. I'll update it and post it in the OP, just a sec.

https://github.com/derp-all-day/PHP-PHD/

[Mongrel]

I have one, I just need to update the source on it. I'll update it and post it in the OP, just a sec.

https://github.com/derp-all-day/PHP-PHD/

Thanks, I may be able to contribute on the weekend.

[Ego Inc]

Just came out with a large-ish update. Now has the abillity to dump tables 'dump()' into runable PHD code to recreate them and there rows, along with a few other odd functions aswell as some internal changes.

[Mr‎‎]

Like the update! Was waiting for something like this :)

- C0der_

[Ego Inc]

Huge update.

###### New Features ######
[X] node.php returns 'failure' on failure to authenticate
[X] 'table()' doesn't require an argument for the case of 'ls()'
[X] can validate a node url by calling 'http://site.com/node.php?validate' and it should return 'valid'.
[X] now class settings contain a blacklist you can add table names to that should not be accessible via remote connection

###### Bug Fixes ######
[X] Improved security of remote connections 'node'
[X] Fixed bug where 'rand()' didn't return the row id at all
[X] Fixed vulnerability where private functions are accessible via remote connections
[X] Fixed bug where you cant create new tables/rows. array()'s now need to be encased in quotes for remote queries.

###### New Functions ######
[X] changePassword()
[X] changed 'ls()' to 'schema()'