XSSMas Challenge 2014<?php # make sure people don't traverse around on the challenge server if($_SERVER['HTTP_HOST'] !== 'cure53.de'){ die('nonono'); } if(preg_match('/\'/', urldecode($_SERVER['QUERY_STRING']))){ echo 'Error: SELECT betreff, text, show FROM news WHERE id = \'='.base64_decode($_SERVER['QUERY_STRING']).'\' You have an error in your SQL syntax; check the manual that corresponds to your MySQL server versi
