<?php
function clean($string){
$string = addslashes($string);
$string = strip_tags($string);
$string = htmlspecialchars($string);
$string = trim($string);
return $string;
}
?>
<?php
$host = "localhost"; // default
$mysql_user = "XXX"; // mysql username
$mysql_pass = "XXX"; // mysql password
$mysql_db = "XXX"; //mysql database
@mysql_connect($host,$mysql_user,$mysql_pass) or die("Could not connect to MySQL<br />".mysql_error());
@mysql_select_db($mysql_db) or die("Could not connect to MySQL database $db");
// Protecção contra SQL Injections para todas as variáveis POST e GET
foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); }
foreach ($_GET as $key => $value) { $_GET[$key] = mysql_real_escape_string($value); }
?>
<?php
ob_start();
require('connect.php');
include('functions.php');
$act = $_GET['act'];
if ($act == "adduser") {
$user=clean($_POST['user']);
$pass=md5(clean($_POST['pass']));
$nome=clean($_POST['nome']);
$sql="INSERT INTO users(user, pass, nome) VALUES('$user', '$pass', '$nome')";
$result=mysql_query($sql);
if($result){
echo"Sucesso!";
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
}else{
echo" Insucesso!";
}
mysql_close();
} elseif ($act == "deluser") {
$user=$_POST['user'];
$sql="DELETE FROM users WHERE user='$user'";
$result=mysql_query($sql);
if($result){
echo"Sucesso!";
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
}else{
echo" Insucesso!";
}
mysql_close();
} elseif (act == "loginerro" || $act == "logindel"){
setcookie("user", "erro", time()+3600);
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
} elseif ($act == "authuser") {
$user = clean($_POST['user']);
$pass = md5(clean($_POST['pass']));
$usercookie = $user;
$sql = "SELECT * FROM `users` WHERE `user` = '$user' AND `pass` = '$pass' LIMIT 1";
$result = mysql_query($sql);
if(!mysql_num_rows($result)){
echo "Nome de utilizador ou password errados!";
setcookie("user", erro, time()+3600);
die();
}else{
echo "Login Válido";
setcookie("user", $usercookie, time()+3600);
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
$logdate = date("Y-m-d");
$logtime = date("h:i:s");
$logip = $REMOTE_ADDR;
$loghost = $_SERVER['HTTP_HOST'];
$logentrada = mysql_query("INSERT INTO logentrada (loguser, logdate, logtime, logip, loghost) VALUES ('$user', '$logdate', '$logtime', '$logip', '$loghost')");
if(!$logentrada) die ('Database error ($logentrada): ' .mysql_error());
mysql_close();
}
}elseif ($act == "addcontent") {
$titulo=$_POST['titulo'];
$conteudo=$_POST['conteudo'];
$tipo=$_POST['tipo'];
$user=$_POST['autor'];
$imagem=$_POST['imagem'];
$data=$_POST['data'];
$hora=$_POST['hora'];
$sql="INSERT INTO content(titulo, conteudo, tipo, autor, imagem, data, hora) VALUES('$titulo', '$conteudo', '$tipo', '$user', '$imagem', '$data', '$hora')";
$result=mysql_query($sql);
if($result){
echo"Sucesso!";
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
}else{
echo" Insucesso!";
}
mysql_close();
} elseif (empty($act)) { echo "Não há nada aqui para ver!"; }
ob_flush()
?>
Refactorings
No refactoring yet !
nicerobot
March 16, 2010, March 16, 2010 11:07, permalink
The "most secure possible login system" does not transmit passwords to the server (secure should mean secure for the user and the system being accessed). At the very minimum, it should be digest authentication. But, ideally it will rely on OpenID or some type of federated login chosen by the user (see http://www.gigya.com/ as an example). If you end up creating "the most secure possible login system", it'll essentially be reproducing all the work that has gone into these other techniques. If you still insist on implementing authentication yourself, you might want to have a look at the PHP portion http://goo.gl/oRVY of a digest authentication i wrote a few years ago http://code.google.com/p/digestj/ (Disclaimer: It's never been through a security audit. It was just a proof of concept for the JavaScriptable digest capability.)
Exos
July 11, 2010, July 11, 2010 17:27, permalink
You have to be more organized and clean. The script is insecure, as check in several places.
<?php
function clean($string){
$string = addslashes($string);
$string = strip_tags($string);
$string = htmlspecialchars($string);
$string = trim($string);
return $string;
}
?>
<?php
$host = "localhost"; // default
$mysql_user = "XXX"; // mysql username
$mysql_pass = "XXX"; // mysql password
$mysql_db = "XXX"; //mysql database
@mysql_connect($host,$mysql_user,$mysql_pass) or die("Could not connect to MySQL<br />".mysql_error());
@mysql_select_db($mysql_db) or die("Could not connect to MySQL database $db");
// Protecção contra SQL Injections para todas as variáveis POST e GET
/* Protejer los datos 2 veces solo dara problemas, si se inglresa una comilla simple, quedará guardada y se mostrara mal */
foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); }
foreach ($_GET as $key => $value) { $_GET[$key] = mysql_real_escape_string($value); }
?>
<?php
ob_start();
require('connect.php');
include('functions.php');
// For use SESSIONS
session_start();
/* chequiamos */
$act = isset($_GET['act']) ? $_GET['act'] : null ;
/* USA switch!!! */
switch ($act) {
case 'adduser':
/* Check vars */
$user= isset($_POST['user']) ? clean($_POST['user']) : null;
$pass= isset($_POST['pass']) ? md5(clean($_POST['pass'])) : null ; // Clean for the MD5? LoL
$nome= isset($_POST['nome']) ? clean($_POST['nome']) : null;
if ($user && $pass && $nome ) {
$sql="INSERT INTO users(user, pass, nome) VALUES('$user', '$pass', '$nome')";
$result=mysql_query($sql);
if($result){
echo"Sucesso!";
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
}else{
echo" Insucesso!";
}
} else {
echo " BadRequest";
}
break;
case 'deluser': /* WTF: Cualquier persona puede borrar a cualquier usuario solo sabiendo elnick? MAL! */
$user= isset($_POST['user']) ? clean($_POST['user']) : null;
$sql="DELETE FROM users WHERE user='$user'";
$result=mysql_query($sql);
if($result){
echo"Sucesso!";
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
}else{
echo" Insucesso!";
}
break;
case 'loginerro':
case 'logindel':
setcookie("user", "erro", time()+3600);
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
break;
case 'authuser':
$user= isset($_POST['user']) ? clean($_POST['user']) : null;
$pass= isset($_POST['pass']) ? md5(clean($_POST['pass'])) : null;
$usercookie = $user;
$sql = "SELECT * FROM `users` WHERE `user` = '$user' AND BINARY `pass` = '$pass' LIMIT 1"; /* usa binary para caracteres especiales y mayus/minus */
$result = mysql_query($sql);
if(!mysql_num_rows($result)){
echo "Nome de utilizador ou password errados!";
setcookie("user", erro, time()+3600);
die();
}else{
echo "Login Válido";
/* ESTO ES SUPER INSEGURO, solo tengo que setear la cookie "user" en mi navegador con el usuario que quiera y ya estoy adentro, en este caso tendrias que usar "$_SESSIONS" y sino puedes por algun motivo, intenta guardando un hash!!!
This is insecure, i can set a cookie in my browser with a some user nickmane and i'm logged in with this user. Yo've use a $_SESSION global var, or generate a HASH string for the cookie content.
*/
$logdate = date("Y-m-d");
// $logtime = date("h:i:s");
$logtime = date("H:i:s"); // h: 1-12, H: 0-23
$logip = $REMOTE_ADDR;
$loghost = $_SERVER['HTTP_HOST'];
// setcookie("user", $usercookie, time()+3600);
$_SESSION['user'] = array (
'user' => $user,
'logtime' => strtotime("$logindate $logintime")
);
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
/* En vez de guardar fecha y hora por separado se puede usar el tipo de datos DATETIME y usar date("Y-m-d H:i:s"); */
$logentrada = mysql_query("INSERT INTO logentrada (loguser, logdate, logtime, logip, loghost) VALUES ('$user', '$logdate', '$logtime', '$logip', '$loghost')");
if(!$logentrada) die ('Database error ($logentrada): ' .mysql_error());
mysql_close();
}
break;
case 'addcontent':
/* CHEK VARS!!! */
$titulo=$_POST['titulo'];
$conteudo=$_POST['conteudo'];
$tipo=$_POST['tipo'];
// De nuevo, cualquiera puede postear como cualqueira?????????
$user=$_POST['autor'];
$imagem=$_POST['imagem'];
$data=$_POST['data'];
$hora=$_POST['hora'];
// $sql="INSERT INTO content(titulo, conteudo, tipo, autor, imagem, data, hora) VALUES('$titulo', '$conteudo', '$tipo', '$user', '$imagem', '$data', '$hora')";
// Be most clean:
$sql="INSERT INTO content SET
titulo = '$titulo',
conteudo = '$conteudo',
tipo = '$tipo',
autor = '$user',
imagem = '$imagem',
data = '$data',
hora = '$hora'
";
$result=mysql_query($sql);
if($result){
echo"Sucesso!";
echo"<meta http-equiv='refresh' content='3;url=utilizadores.php'>";
}else{
echo" Insucesso!";
}
break;
default:
echo "Não há nada aqui para ver!";
}
mysql_close();
ob_flush()
?>
flellareire
September 4, 2011, September 04, 2011 10:52, permalink
Thanks mate... just dropped by.!!!!! Will look for BIKE STN when we get to Seattle. Still in Buenos Airies.!!!!!
artyom
September 19, 2011, September 19, 2011 07:50, permalink
how many time i do not do what i want to do but do what i dont want to do
NarbrommagDug
September 7, 2011, September 07, 2011 04:49, permalink
Thanks mate... just dropped by.!!!!! Will look for BIKE STN when we get to Seattle. Still in Buenos Airies.!!!!!
abrantTar
September 19, 2011, September 19, 2011 16:19, permalink
Thanks mate... just dropped by.!!!!! Will look for BIKE STN when we get to Seattle. Still in Buenos Airies.!!!!!
intooosl
September 8, 2011, September 08, 2011 18:36, permalink
how many time i do not do what i want to do but do what i dont want to do
Cacralley
September 20, 2011, September 20, 2011 20:32, permalink
Thanks mate... just dropped by.!!!!! Will look for BIKE STN when we get to Seattle. Still in Buenos Airies.!!!!!
andgeiil
September 21, 2011, September 21, 2011 20:30, permalink
how many time i do not do what i want to do but do what i dont want to do
konoodd
September 25, 2011, September 25, 2011 15:46, permalink
how many time i do not do what i want to do but do what i dont want to do
rorkedmedia
November 1, 2011, November 01, 2011 11:28, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
SWASIAWOUMS
December 24, 2011, December 24, 2011 21:06, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
Peeleaskirl
November 19, 2011, November 19, 2011 18:03, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
vostenofs
November 16, 2011, November 16, 2011 13:49, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
nocaoccub
November 12, 2011, November 12, 2011 06:05, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
erunnyutesy
November 15, 2011, November 15, 2011 06:04, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
Rilsotbloth
November 20, 2011, November 20, 2011 17:20, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
deermcregmene
December 22, 2011, December 22, 2011 19:18, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
jhonnybook
December 23, 2011, December 23, 2011 02:36, permalink
Free books on programming
http://goo.gl/wydGX
Technology books here
boubjesee
November 27, 2011, November 27, 2011 06:44, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
elafDeema
November 27, 2011, November 27, 2011 17:59, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
reesetrumszet
November 29, 2011, November 29, 2011 19:36, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
boookloy
February 3, 2012, February 03, 2012 21:19, permalink
Télécharger des livres gratuitement ici:
http://bookgrill.com/?getez.html
Livres Technology ici
addichaccipsy
December 28, 2011, December 28, 2011 10:33, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
FabsBlammaKah
December 28, 2011, December 28, 2011 19:51, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
PienWonee
December 29, 2011, December 29, 2011 01:19, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
Invoixmoott
December 29, 2011, December 29, 2011 21:04, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
beistMuGseeks
December 29, 2011, December 29, 2011 21:42, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
jhonnybook
December 31, 2011, December 31, 2011 07:55, permalink
Download free books here :
http://goo.gl/hdL2a
Free books
JeannePerdue
January 7, 2012, January 07, 2012 07:10, permalink
Bonjour à tous et à toutes ! Je ne sais pas vraiment si je suis dans le bon endroit pour poster ma demande et je n'ai pas trop l'habitude de ces forums ! Je m'explique : j'ai 58 ans et je suis une novice dans le domaine de l'internet et des "nouvelles technologies" : cela ne fait que deux mois que j'ai pris une "liveboxe".
Je ne vais pas vous embeter avec ma vie actuelle plus longtemps. Je suis un peu supersticieuse et je cherche des retours d'expérience de personnes qui seraient dans mon cas.
Avant d'avoir internet, je passais beaucoup de temps au téléphone avec des voyants et divers médiums. J'en avais trouvé quelques uns de pas mauvais mais je me suis toujours un peu méfiée de ces personnes qui sont à l'autre bout du fil. Depusi quelques temps, je me suis mis en tête de chercher des sites où je pourrais discuter gratuitement avec des médiums. J'en ai trouvé quelques uns et retenu une liste de sites qui m'avaient l'air sérieux. Pouvez vous me dire si vous les avez testé ? Voici ma liste pour le moment :
http://www.voyance-consult.com
http://www.voyance-consult.com
http://www.voyance--par--telephone.com
Avez vous testé ces sites ? Sinon, avez vous d'autres sites à me conseiller ? J'ai vraiment besoin d'un peu d'aide. J'avoue être supersticieuse et passer beaucoup de temps à connaitre mon avenir par diverses méthodes (j'ai un cancer et cela me stresse beaucoup). Je ne peux pas me permettre de dépenser beaucoup d'argent pour trouver un bon voyant alors toute aide sera la bienvenue.
Je vous remercie de votre aide à tous !
booky
January 12, 2012, January 12, 2012 10:45, permalink
BookGrill.com : eBooks gratuits
http://goo.gl/RffUX
livres gratuits
bbooky
January 15, 2012, January 15, 2012 09:48, permalink
EBooks ici!
http://goo.gl/lzHU6
Obtenez gratuitement des livres
Toinnygor
January 15, 2012, January 15, 2012 13:50, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
Feriordedia
January 16, 2012, January 16, 2012 12:39, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
bbooky
January 20, 2012, January 20, 2012 09:40, permalink
Livres gratuits , mises à jour quotidiennes
http://goo.gl/ArLHw
Livres au format PDF
Tawdielflyday
January 20, 2012, January 20, 2012 16:40, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe. what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
KNEEDGINGTHOG
January 20, 2012, January 20, 2012 18:54, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
bovokwoy
January 24, 2012, January 24, 2012 21:35, permalink
Livres Android :
http://bookgrill.com/?getey.html
Téléchargez ici gratuitement des livres
boboktoy
January 29, 2012, January 29, 2012 19:50, permalink
Télécharger des livres en format PDF gratuitement
http://bookgrill.com/?geteb.html
Livres Technology ici
Hello People,
This website just came to my attention and the idea is great! I'm already counting on expert help just by seing some 2 or 3 refactorings.
I'm not an expert programmer and I need all the help I can get to have this done the best way possible. I want to make the most secure possible login system and content submital to a mySQL database. I rely on a file I called motor.php to do all the work with the DB and here I needed seriously refactoring (I guess!) ... then I have a basic functions.php (from this file I only put here 1 function ... to get your opinion about it) and a connect.php
So ... if you guys can help me ... thanks A LOT !