Someone Trying Weird Things With My Get Variables

I noticed a number of strange attempts to replace my get vars with URLs

[gcarn]

Hi

I Run a site for my band.. its not something i would consider a target.. but anyways..

I noticed over the last 2 days, there were 20 strange entries in my logs, comming from 2 different Ip's.

At exatly the same time (to the second) about 12 hits came, replacing simple get vars (like action and galleryID) from my numeric value, to a URL.

Obviously, im not going to post the exact entries, but the urls are all different extensions (.biz, .org, .ru, .be, .com ect)

something like
mysitehere.com/somefile.php?action=http%3A%2F%2Fwww.someurl.be%2Fsomething%2Fsomething%2F2Fsomethingelse%22Fsomething%2F&galleryID=11

Every one of them came from a unique session ID, at the exact same second, from the same Ip,

Then it happened again the next day from a different IP. (with different urls, but the same idea)

Im not worried persay, but im really puzzled as to what they were trying to attempt.

I cant what their goal might have been.. its not like they were sql commands being plugged in or anything like that.

Has anyone seen anything like this before, or have any idea what somewhat might be attempting. Or any steps I should take to be extra carefull about this kinda stuff?

[StoutFiles]

Did you go to the url? And what does the action variable do on the somefile.php page?

[gcarn]

the url's seem like clean legit sites, some of the forgen domains are iffy.. just because their weird looking to me.. but still seem legit.
there was even a .org that seems very proper.

the action variable controls the page stance, action = viewGallery or something of that nature.

sometimes the varible replaced pulls info from a database... like select * from galleries where gallery ID=http%3A%2F%2Fwww.someurl.be%2Fsomething%2Fsomething%2F2Fsomethingelse%22Fsomething

and would just result in an error

I wonder if they were looking for something that auto bumped you, so as to seem like it came like a referrer from my site or something of that nature.

[eelixduppy]

>> Has anyone seen anything like this before

I've seen this but not trying to hack a MySQL database but rather includes and functions of that sort. As long as you are properly handling the input from the user then you should be fine. That includes escaping the data as well as making sure that the data is in the correct format. For instance, it looks like your script takes an integer ID number; you should check to see if the input is an integer (or cast it to one) before constructing your query.

[pageoneresults]

Im not worried persay, but im really puzzled as to what they were trying to attempt.

Log Spamming?

[gcarn]

pageonresults,
yes, Logspamming might make alot ofsense
I read the post here [webmasterworld.com...]
and that seemed to explain alot of things.

I learned something new today! Logspamming!
Thanks