Въпрос към тези кодове

philips300 · 2 Август 2010

Искам да ви питам дали има някаква защита от хакере благодаря предварително/Извинявам се ако темата не е за тук//

config

Код:

<?php
mysql_connect("localhost","root","");
@mysql_select_db("gasi") or die( "Има грешка с Датабазата.");
 
 $admin="Admin";
 $admin_pass="Password";

 $admin2="Admin2";
 $admin2_pass="Password2";
 
$time = time();
mysql_query("DELETE FROM goraip WHERE time <= '$time'");
mysql_query("DELETE FROM ips WHERE time <= '$time'");
?>

klasacia

Код:

 <h3>
       <br />
        <h3>
       <br />
 <div align="center">
  <div class="body" style="background-position:center; width:540px;"> <span class="style1"><blink><strong>ДАВАЙ ЖЕГА</strong></blink></span><br />
      <?php
include("config.php");
function selfURL() {
$s = empty($_SERVER["HTTPS"]) ? ''
: ($_SERVER["HTTPS"] == "on") ? "s"
: "";
 preg_match_all('/(.*)\//',$_SERVER['SCRIPT_NAME'],$lq);
$protocol = strleft(strtolower($_SERVER["SERVER_PROTOCOL"]), "/").$s;
$port = ($_SERVER["SERVER_PORT"] == "80") ? ""
: (":".$_SERVER["SERVER_PORT"]);
return $protocol."://".$_SERVER['SERVER_NAME'].$port.$lq[0][0];
}
function strleft($s1, $s2) {
return substr($s1, 0, strpos($s1, $s2));
}
$url = selfURL();
$vote = "vote.php?l=vote&id";
$path = $url.$vote;
$broinastranica = 12;
$pageNum = 1;
if(isset($_GET['page']))
{
$pageNum = $_GET['page'];
}
$redove = ($pageNum - 1) * $broinastranica;
$query = " SELECT * FROM gora ORDER BY lista DESC LIMIT $redove, $broinastranica";
$result = mysql_query($query) or die('Error, query failed');
echo "<table border=1 width=300 align=center>";
echo '<tr><td>№</td><td>Сървъри</td><td>Точки</td><td>Скайп</td></tr><td>';
while($row = mysql_fetch_array($result))
{
echo '<tr><td>'.$row['id'].'</td><td><a href='.$path.'='.$row['id'].'>'.$row['name'].'</a></td><td>'.$row['lista'].'</td><td><a href=skype:'.$row['mail'].'?chat>Chat</a></td></tr>';

}
echo"</table>";
$query = "SELECT COUNT(name) AS numrows FROM gora";
$result = mysql_query($query) or die('Error, query failed');
$row = mysql_fetch_array($result, MYSQL_ASSOC);
$numrows = $row['numrows'];
$maxPage = ceil($numrows/$broinastranica);
$self = $_SERVER['PHP_SELF'];
$nomeranastranici = '';
for($page = 1; $page <= $maxPage; $page++)
{
if ($page == $pageNum)
{
$nomeranastranici .= " $page ";
}
else
{
$nomeranastranici .= " <a href=\"$self?page=$page\">$page</a> ";
}
}
if ($pageNum > 1)
{
$page = $pageNum - 1;
$predishna = " <a href=\"$self?page=$page\"> << </a> ";

$parva = " <a href=\"$self?page=1\">първа</a> ";
}
else
{
$predishna = ' ';
$parva = ' ';
}
if ($pageNum < $maxPage)
{
$page = $pageNum + 1;
$sledvashta = " <a href=\"$self?page=$page\"> >> </a> ";
$posledna = " <a href=\"$self?page=$maxPage\">последна</a> ";
}
else
{
$sledvashta = ' ';
$posledna = ' ';
}
echo "<center>Страница: $parva  $predishna  $nomeranastranici  $sledvashta  $posledna</center>";
?>
      <br />
    <br />
    <br />
  </div>
  </div>
<div align="center"></div>
</body>
</html>

registracia

Код:

<div align="center">
  <div style="background-position:center; width:540px;" class="body">
    <p align="center"> </p>
    <form action="" method="post">
        <center>
        <h3>
       <br />
        <center>
         <h3>
       <br
        <h3>
       <br />
        <center>
         <h3>
       <br
       <center>
	    <span class="style8">Вашето име в игра:<span class="style9">...............</span> </span>
        <input name="gora" type="text" size="20" />
      </h3>
      <br />
      <center>
        <h3><span class="style8">Скайп:</span><span class="style9">................................ 
          </span>
          <input name="mail" type="text" size="20" />
      </h3>
      </center>
      <br />
      <center>
        <h3><span class="style8">И-мейл:</span><span class="style9">..............................
          </span>
          <input name="skype" type="text" size="20" />
      </h3>
      </center>
      <br />
      <center>
        <input type="submit" name="buton" value="Създай СЪРВЪР" />
      </center>
    </form>
    </center>
	</div>

    <?php
include("config.php");
function selfURL() {
$s = empty($_SERVER["HTTPS"]) ? ''
: ($_SERVER["HTTPS"] == "on") ? "s"
: "";
 preg_match_all('/(.*)\//',$_SERVER['SCRIPT_NAME'],$lq);
$protocol = strleft(strtolower($_SERVER["SERVER_PROTOCOL"]), "/").$s;
$port = ($_SERVER["SERVER_PORT"] == "80") ? ""
: (":".$_SERVER["SERVER_PORT"]);
return $protocol."://".$_SERVER['SERVER_NAME'].$port.$lq[0][0];
}
function strleft($s1, $s2) {
return substr($s1, 0, strpos($s1, $s2));
}
$url = selfURL();
$vote = "vote.php?l=vote&id";
$path = $url.$vote;
if($_POST['buton'])
{
$gora=htmlspecialchars($_POST['gora']);
$mail=htmlspecialchars($_POST['mail']);
$ip=$_SERVER["REMOTE_ADDR"];
$query1="SELECT * from gora where name like '$gora' ";
$result1=mysql_query($query1);

if ($_POST['gora'] == NULL)
{
echo "<b>Моля въведете някакво име!</b>";
}
else if ($_POST['mail'] == NULL)
{
echo "<b>Моля въведете И-мейл!</b>";
}
else
{
if (mysql_num_rows($result1)>0)
{
echo "Този Сървър<b>$gora</b> вече същестува!<br>Моля изберете друго IP за вашата регистрация.";
}
else
{

$sql = "INSERT INTO `gora` VALUES('', '$gora', '1', '$mail');";
if(mysql_query($sql) != "")
{
$query = mysql_query("SELECT * FROM `gora` WHERE name='$gora' LIMIT 1;");
$row=mysql_fetch_array($query);
$goraid=$row[id];
$gora=$row[name];
$sql2 = "INSERT INTO `gradip` VALUES('', '$goraid', '$ip' );";
$q=mysql_query($sql2);
echo "Вашето Име <b>$gora</b> беше създаден успешно!";
echo "<br>";
echo "Вашият уникален линк е <a href=\"$path=$goraid\">$path=$goraid</a><br>";
echo "Регистрация е добавен от IP: <b>$ip</b>";
}else
{
echo "Регистрация не беше създаден! Има грешка с mysql-a!";
}
}
}
}
?>
    <br />
    <br />
    <br />
  </div>
  </div>
<div align="center"></div>
</body>
</html>

vote

Код:

 <center>
         <h3>
       <br
       <center>
<div align="center"; style="background-image:url(images/headline2.png); background-position:center; background-repeat:no-repeat; margin-top:-40px;"><br />
  
<div align="center">
  <p class="style8"><span class="body" style="background-position:center; width:540px;">
    <?php
include("config.php");


$id = $_GET['id'];
$ip = $_SERVER["REMOTE_ADDR"];
$query1 = "SELECT * FROM goraip WHERE ip='$ip' AND gora_id='$id'";
$result1=mysql_query($query1) or die(mysql_error());
$damian = "SELECT * FROM gora WHERE id='$id'";
$damian1 = mysql_query($damian);
$damian2=mysql_fetch_array($damian1);
$damian3=$damian2[lista];


if ($damian3<50){$building='1'; $ostavashti='50'; } 
if ($damian3>=50 and $damian3<100){$building='2' ; $ostavashti='100';}
if ($damian3>=100 and $damian3<200){$building='3'; $ostavashti='200'; } 
if ($damian3>=200 and $damian3<400){$building='4' ; $ostavashti='400';} 
if ($damian3>=400 and $damian3<600){$building='5' ; $ostavashti='600';} 
if ($damian3>=600 and $damian3<800){$building='6' ; $ostavashti='800';} 
if ($damian3>=800 and $damian3<1000){$building='7' ; $ostavashti='1000';} 
if ($damian3>=1000 and $damian3<1500){$building='8' ; $ostavashti='1500';} 
if ($damian3>=1501){$building='9';}


$dosledva6tonivo=$ostavashti-$damian3;
$shouldfind="$goraid се нуждае от още $dosledva6tonivo посещения за следващата Картинка.<br><br>Картинки: $building/40 ";
if ($damian3>=1500){$building='9'; $shouldfind="Този ПИЧ има всички Картинки";}
if (mysql_num_rows($result1)>0)
{
$query = "SELECT * FROM gora WHERE id='$id'";
$result = mysql_query($query);
$row=mysql_fetch_array($result);
$lista=$row[lista];
echo("<center>В момента има $lista посещения. $shouldfind<br><img src='images/buildings/$building.jpg' WIDTH=520 height=420 ></center>");
}
else
{
$query = "SELECT * FROM gora WHERE id='$id'";
$result = mysql_query($query);
$row=mysql_fetch_array($result);
$lista=$row[lista];
$goraid=$row[id];
$gora=$row[name];
$newlista= $lista + 2;
$time = time() +86400;
$sql3 = "INSERT INTO `goraip` VALUES('', '$goraid', '$ip', '$time' );";
if(mysql_query($sql3) != "")
{
$sql="UPDATE gora SET lista='$newlista' where id='$id';";
if(mysql_query($sql) != "")
{
echo("<center>Успешно даде своето посещение. $goraid в момента има $lista+1 посещения<br><img src='images/buildings/$building.jpg' WIDTH=520 height=420 ></center>");
}else
{
echo "има грешка с  mysql-a!";
}
}
}
?>
  </span></p>
</div>
<div align="center"></div>
</body>
</html>

emagi · 2 Август 2010

Аз поне не видях!
МОже и да съм пропуснал!

philips300 · 2 Август 2010

emagi каза:
Аз поне не видях!
МОже и да съм пропуснал!

здравеи ем казаха ми че нямала никаква защита по тях :S

Karcho · 2 Август 2010

Код:

Защити id-то на vote.
Направи vote.php ето така:
	  <center>
         <h3>
       <br
       <center>
<div align="center"; style="background-image:url(images/headline2.png); background-position:center; background-repeat:no-repeat; margin-top:-40px;"><br />
 
<div align="center">
  <p class="style8"><span class="body" style="background-position:center; width:540px;">
    <?php
include("config.php");


$id = (int)$_GET['id'];
if($id>0) {
$ip = $_SERVER["REMOTE_ADDR"];
$query1 = "SELECT * FROM goraip WHERE ip='$ip' AND gora_id='$id'";
$result1=mysql_query($query1) or die(mysql_error());
$damian = "SELECT * FROM gora WHERE id='$id'";
$damian1 = mysql_query($damian);
$damian2=mysql_fetch_array($damian1);
$damian3=$damian2[lista];


if ($damian3<50){$building='1'; $ostavashti='50'; }
if ($damian3>=50 and $damian3<100){$building='2' ; $ostavashti='100';}
if ($damian3>=100 and $damian3<200){$building='3'; $ostavashti='200'; }
if ($damian3>=200 and $damian3<400){$building='4' ; $ostavashti='400';}
if ($damian3>=400 and $damian3<600){$building='5' ; $ostavashti='600';}
if ($damian3>=600 and $damian3<800){$building='6' ; $ostavashti='800';}
if ($damian3>=800 and $damian3<1000){$building='7' ; $ostavashti='1000';}
if ($damian3>=1000 and $damian3<1500){$building='8' ; $ostavashti='1500';}
if ($damian3>=1501){$building='9';}


$dosledva6tonivo=$ostavashti-$damian3;
$shouldfind="$goraid се нуждае от още $dosledva6tonivo посещения за следващата Картинка.<br><br>Картинки: $building/40 ";
if ($damian3>=1500){$building='9'; $shouldfind="Този ПИЧ има всички Картинки";}
if (mysql_num_rows($result1)>0)
{
$query = "SELECT * FROM gora WHERE id='$id'";
$result = mysql_query($query);
$row=mysql_fetch_array($result);
$lista=$row[lista];
echo("<center>В момента има $lista посещения. $shouldfind<br><img src='images/buildings/$building.jpg' WIDTH=520 height=420 ></center>");
}
else
{
$query = "SELECT * FROM gora WHERE id='$id'";
$result = mysql_query($query);
$row=mysql_fetch_array($result);
$lista=$row[lista];
$goraid=$row[id];
$gora=$row[name];
$newlista= $lista + 2;
$time = time() +86400;
$sql3 = "INSERT INTO `goraip` VALUES('', '$goraid', '$ip', '$time' );";
if(mysql_query($sql3) != "")
{
$sql="UPDATE gora SET lista='$newlista' where id='$id';";
if(mysql_query($sql) != "")
{
echo("<center>Успешно даде своето посещение. $goraid в момента има $lista+1 посещения<br><img src='images/buildings/$building.jpg' WIDTH=520 height=420 ></center>");
}else
{
echo "има грешка с  mysql-a!";
}
}
}
}
?>
  </span></p>
</div>
<div align="center"></div>
</body>
</html>

другаде няма, поне аз не видях, както emagi.

philips300 · 2 Август 2010

Karcho каза:

Код:

Защити id-то на vote.
Направи vote.php ето така:
	  <center>
         <h3>
       <br
       <center>
<div align="center"; style="background-image:url(images/headline2.png); background-position:center; background-repeat:no-repeat; margin-top:-40px;"><br />
 
<div align="center">
  <p class="style8"><span class="body" style="background-position:center; width:540px;">
    <?php
include("config.php");


$id = (int)$_GET['id'];
if($id>0) {
$ip = $_SERVER["REMOTE_ADDR"];
$query1 = "SELECT * FROM goraip WHERE ip='$ip' AND gora_id='$id'";
$result1=mysql_query($query1) or die(mysql_error());
$damian = "SELECT * FROM gora WHERE id='$id'";
$damian1 = mysql_query($damian);
$damian2=mysql_fetch_array($damian1);
$damian3=$damian2[lista];


if ($damian3<50){$building='1'; $ostavashti='50'; }
if ($damian3>=50 and $damian3<100){$building='2' ; $ostavashti='100';}
if ($damian3>=100 and $damian3<200){$building='3'; $ostavashti='200'; }
if ($damian3>=200 and $damian3<400){$building='4' ; $ostavashti='400';}
if ($damian3>=400 and $damian3<600){$building='5' ; $ostavashti='600';}
if ($damian3>=600 and $damian3<800){$building='6' ; $ostavashti='800';}
if ($damian3>=800 and $damian3<1000){$building='7' ; $ostavashti='1000';}
if ($damian3>=1000 and $damian3<1500){$building='8' ; $ostavashti='1500';}
if ($damian3>=1501){$building='9';}


$dosledva6tonivo=$ostavashti-$damian3;
$shouldfind="$goraid се нуждае от още $dosledva6tonivo посещения за следващата Картинка.<br><br>Картинки: $building/40 ";
if ($damian3>=1500){$building='9'; $shouldfind="Този ПИЧ има всички Картинки";}
if (mysql_num_rows($result1)>0)
{
$query = "SELECT * FROM gora WHERE id='$id'";
$result = mysql_query($query);
$row=mysql_fetch_array($result);
$lista=$row[lista];
echo("<center>В момента има $lista посещения. $shouldfind<br><img src='images/buildings/$building.jpg' WIDTH=520 height=420 ></center>");
}
else
{
$query = "SELECT * FROM gora WHERE id='$id'";
$result = mysql_query($query);
$row=mysql_fetch_array($result);
$lista=$row[lista];
$goraid=$row[id];
$gora=$row[name];
$newlista= $lista + 2;
$time = time() +86400;
$sql3 = "INSERT INTO `goraip` VALUES('', '$goraid', '$ip', '$time' );";
if(mysql_query($sql3) != "")
{
$sql="UPDATE gora SET lista='$newlista' where id='$id';";
if(mysql_query($sql) != "")
{
echo("<center>Успешно даде своето посещение. $goraid в момента има $lista+1 посещения<br><img src='images/buildings/$building.jpg' WIDTH=520 height=420 ></center>");
}else
{
echo "има грешка с  mysql-a!";
}
}
}
}
?>
  </span></p>
</div>
<div align="center"></div>
</body>
</html>

другаде няма, поне аз не видях, както emagi.

благодаря ви за голямото внимание

Въпрос към тези кодове

philips300

Registered

emagi

Registered

philips300

Registered

Karcho

Registered

philips300

Registered