guestbook wiped by "hacker"

[lee]

Hi - I just wondered if anyone else has had their guestbook wiped by a malicious user. The php scripts look unchanged/unharmed, but the entries.txt file is blank.

Anyone know how this is done? I know nothing about hacking or scripting, but my guess is that it was via the php script, as opposed to a hack into the site from another route, as there was an email notification from the guestbook as it happened!

regards,

lee
www.victorianlondon.org

[Klemen]

Lee,

I doubt your guestbook was "hacked". If you received an e-mail notification when it happened the problem probably was that your server was under too much load and tried to write to too many files at a time (or to write different input to the same file) and thus truncated/emptied the file.

This is a known issue with text databases and I've seen it happen before in hit counters. If you have a website with many visitors or if your guestbook is under a lot of pressure (many submissions) I would suggest that you find a guestbook with MySQL database.

Regards

[Me59]

make sure your webspace (index of files) can not be browsed by visitors.

Many incompetent provider allow this by default - especially in the EU and USA this is fairly common. This way, every visitor can see/target and maybe alter/delete your files.

[Klemen]

True, you can either prevent that by .htaccess (on Apache):

Options -Indexes

orsimply place a blank index.htm file to every folder.

[Me59]

Just yesterday I was learning alot about .htaccess - preventing site ripping (copycats) was one issue and switching off file view another.

Blocking the file view can be done by adding:
IndexIgnore *

Don't forget to CHMOD to 644 otherwise the visitor can view your .htaccess

[Klemen]

Yup, .htaccess is a quite useful little file

IndexIgnore *

Same result with

Options -Indexes

use either.

How are you preventing copycapts with .htaccess? I don't think there is a reliable way of doing it, or is it?

[Me59]

Klemen,

Everything is here - a very nice tutor!

http://www.javascriptkit.com/howto/htaccess.shtml

[Klemen]

Pretty cool, thanks!