There are some exploits on forums worth mentioning and that is exactly what I am going to do.
I will let you know how people use them and how to patch it and protect yourselves.

Here are some exploits:
SQL injection
Buffer overflow
Javascript & HTML attacks

I'll run down them by order.

SQL Injection

SQL injection is a data editing language. You can use them to update, remove, add, gather, any kind of data.
There are plenty of simple SQL injections such as a password bypass.
A password bypass is a string that lets you log in as admin without the password.
for example.
Code: [Select]admin:' or 1=1--
password:' or 1=1--
admin:' or 'a'='a'#
you put that in the password box, you don't even need a user name.

Another sql injection is using the url box to find data and change it.
I don't have time or space to get into this, but just know that people can use the url box to gather information.

How do you know if a site a vulnerable?
with the password bypass like I showed you above you need to try it and if it works it is vulnerable.
For more advanced things you will look for a section in the url box that looks like "php?" The "?" is important.

The most common place for an sql injection to start is in a members list. click on a member and you'll see something like "user_id=1".

If all this is true, this site is vulnerable.

How do you fix it? Let me start with mentioning most of the places this works is only on a forum. It is run by php and has sql script in the source.
You can find patches for the sql script. It is a simple fix. just google for a patch for it and wahlah.

Buffer Overflow
Buffer overflow is a program that you run to overflow the login script so you can log in as admin.
normally for this to happen the ATTACKER knows a programming language or they have a program they FOUND on a site.

How do you stop this? Like most things you need to find a site with a vulnerability fix for this. Protecting yourself has a lot of searching involved. You need to learn about a new vulnerability and then search for a fix.

Javascript / HTML attacks

I bet you didnt know website scripting languages can be used to control your server from the out side.
Well lets use myspace as a example. In the old days myspace allowed html and javascript codes in a comment. People could use this to control the PERSONS myspace, they could change the background and make popup boxes to say things they wanted.

Another thing is guest books. Most guest books (especially old ones) allow javascript and html codes.

This is a very simple fix. (and no searching!)
Find the control panel over the posting part on the guest book or forum and disable javascript and html coding.

Well I tried to make this short and easy to read yet descriptive.

Hope you enjoy,
S_R_SIm really confused
But nice advice really.I'm sorry but I fail to see the point of this post.
The things you warn against have little or no merit for the average user.
Let me break down my critique by topic.

SQL Injection
Is a vulnerability type that affects SQL servers. SQL servers are often used as the backend for websites with dynamic content (like forums). The average user isn't running a SQL server.
Furthermore your advice for fixing SQL injection vulnerabilities is so generic this entire section could have been summed up with "Keep your website software patched and up to date!".

Buffer Overflow
Buffer overflow is not a program and it doesn't only affect login scripts. It is a type of vulnerability that stems from poor programming practices. It can manifest it self when software fails to properly validate the input it receives. This can, if successful, allow the attacker to replace part of the software code with his own code. More commonly buffer overflows make software crash. Actually buffer overflows doesn't even have to be malicious. This can happen under normal operating conditions when a piece of software receives input it wasn't designed to deal with. If the programmer haven't taken proper steps to deal with such a situation it can result in a buffer overflow.
Again your advice for protection is so generic it be summed up as "keep your software up to date!".

Javascript / HTML attacks
Again you tell the server's side of the story, not something that have any value for the average user.


You may find my critique harsh but don't get me wrong, I applaud you for wanting to educate people about security. I just think you've chosen the wrong subjects/angles to write about. Below I've taken two of your topics (I just can't make SQL user relevant) and suggested a few things you could write about to make it more user relevant.

Buffer Overflow
Why not talk about the fact that most software installed on a computer (including windows) can potentially be vulnerable to buffer overflows. Here you could talk about how to keep windows and software up to date. Here I would also mention Secunia's PSI that warn you if software you have installed have known security issues.
There is also security software that tries to prevent malicious software from taking over legitimate software (for example by buffer overflow). One example would be Comodo. If you have a recent processor and XP SP2 or newer you actually have some BUILT in protection against buffer overflows. This is called Data Execution Prevention.

Javascript / HTML attacks
Why not talk about the fact that most browser exploits today is delivered via javascript and how USERS can protect themselves against these exploits. For example you could mention the excellent NoScript plugin for Firefox that render most 0-day vulnerabilities for Firefox useless (if the plugin is active of course).
Yes, it is very confusing...but a good start to adding to one's awareness...