XSS система за коментари

S

stan4obg

Registered
Добър ден имам един код който е за коментари + db . И има xss уязвимост пробвах много начини за блокиране но нещо не става моля някой дами помогне или да ми даде нов код за коментари не бъда благодарен давам + че :lol:

Код: 
<form action="" method="post">
<table width="250" border="0" align="center" cellpadding="3" cellspacing="1">
<tr>
<td>Коментар:<br>
<textarea name="comment" cols="15" rows="3" class="textinput" id="m"></textarea></td>
</tr>
<tr>
<td>Име:<br>
<input type="text" name="name" id="name"></td>
</tr>
<tr>
<td>
<input name="submit" type="submit" class="btn" id="submit" value="Изпрати">
<input name="button2" type="reset" class="btn" id="button2" value="Изчисти">
<?php
include("config.php");
$id = $_GET['id'];
if(isset($_POST['submit'])){
$date = date("d.m.Y");
$sql = mysql_query("INSERT INTO comment (id, article, author, comment, date) VALUES (NULL, '$id', '$_POST[name]', '$_POST[comment]', '$date')") or die(mysql_error());
}
else {
echo "";
}
?></td>
</tr>
</table>
</form>
<br>
<table width="380" border="0" align="center" cellpadding="1" cellspacing="1">
<?php
$query = mysql_query("SELECT * FROM `comment` WHERE `article`='$id'") or die(mysql_error());
while($raw = mysql_fetch_array($query)){
echo "
<tr>
<td class=\"comment\" style=\"border-bottom: 1px solid #000000\">От $raw[date] | <span class=\"style2\">$raw[author]</span><br>
$raw[comment]</td>
</tr>";
}
?>
 
PHP: 
<?php
include("config.php");
$id = (int)$_GET['id'];
if(isset($_POST['submit'])){
$date = date("d.m.Y");
$name = addslashes(htmlspecialchars($_POST['name']));
$comment = addslashes(htmlspecialchars($_POST['comment']));
$sql = mysql_query("INSERT INTO comment (id, article, author, comment, date) VALUES (NULL, '$id', '$name', '$comment', '$date')") or die(mysql_error());
}
else {
echo "";
}
?></td>
</tr>
</table>
</form>
<br>
<table width="380" border="0" align="center" cellpadding="1" cellspacing="1">
<?php
$query = mysql_query("SELECT * FROM `comment` WHERE `article`='$id'") or die(mysql_error());
while($raw = mysql_fetch_array($query)){
echo "
<tr>
<td class=\"comment\" style=\"border-bottom: 1px solid #000000\">От $raw['date'] | <span class=\"style2\">$raw['author']</span><br>
$raw[comment]</td>
</tr>";
}
?>
 
Ами така...?
PHP: 
<form action="" method="post">
<table width="250" border="0" align="center" cellpadding="3" cellspacing="1">
<tr>
<td>Коментар:<br>
<textarea name="comment" cols="15" rows="3" class="textinput" id="m"></textarea></td>
</tr>
<tr>
<td>Име:<br>
<input type="text" name="name" id="name"></td>
</tr>
<tr>
<td>
<input name="submit" type="submit" class="btn" id="submit" value="Изпрати">
<input name="button2" type="reset" class="btn" id="button2" value="Изчисти">
<?php
include("config.php");
$id = (int)$_GET['id'];
if(isset($_POST['submit'])){
$name = addslashes(htmlspecialchars($_POST['name']))
$comment = addslashes(htmlspecialchars($_POST['comment']));
$date = date("d.m.Y");
$sql = mysql_query("INSERT INTO comment (id, article, author, comment, date) VALUES (NULL, '$id', '$name', '$comment', '$date')") or die(mysql_error());
}
else {
echo "";
}
?></td>
</tr>
</table>
</form>
<br>
<table width="380" border="0" align="center" cellpadding="1" cellspacing="1">
<?php
$query = mysql_query("SELECT * FROM `comment` WHERE `article`='$id'") or die(mysql_error());
while($raw = mysql_fetch_array($query)){
echo "
<tr>
<td class=\"comment\" style=\"border-bottom: 1px solid #000000\">От $raw[date] | <span class=\"style2\">$raw[author]</span><br>
$raw[comment]</td>
</tr>";
}
?>

-----------------------------------------------------------------------

ЕДИТ: Еееее докато го добавя и тедо ме е изпреварил.... :D
 
Parse error: syntax error, unexpected T_VARIABLE in /home/a7702893/public_html/view.php on line 177



$comment = addslashes(htmlspecialchars($_POST['comment']));

странно :idea:
 
PHP: 
<form action="" method="post">
<table width="250" border="0" align="center" cellpadding="3" cellspacing="1">
<tr>
<td>Коментар:<br>
<textarea name="comment" cols="15" rows="3" class="textinput" id="m"></textarea></td>
</tr>
<tr>
<td>Име:<br>
<input type="text" name="name" id="name"></td>
</tr>
<tr>
<td>
<input name="submit" type="submit" class="btn" id="submit" value="Изпрати">
<input name="button2" type="reset" class="btn" id="button2" value="Изчисти">
<?php
include("config.php");
$id = (int)$_GET['id'];
if(isset($_POST['submit'])){
$name = addslashes(htmlspecialchars($_POST['name']));
$comment = addslashes(htmlspecialchars($_POST['comment']));
$date = date("d.m.Y");
$sql = mysql_query("INSERT INTO comment (id, article, author, comment, date) VALUES (NULL, '$id', '$name', '$comment', '$date')") or die(mysql_error());
}
else {
echo "";
}
?></td>
</tr>
</table>
</form>
<br>
<table width="380" border="0" align="center" cellpadding="1" cellspacing="1">
<?php
$query = mysql_query("SELECT * FROM `comment` WHERE `article`='$id'") or die(mysql_error());
while($raw = mysql_fetch_array($query)){
echo "
<tr>
<td class=\"comment\" style=\"border-bottom: 1px solid #000000\">От $raw[date] | <span class=\"style2\">$raw[author]</span><br>
$raw[comment]</td>
</tr>";
}
?>

Ако си копирал на @streleca в неговия има пропусната ; аз съм ти я оправил,пробвай така.
 
Какво си пробвал? :D Всичките ти входни данни са "отворени". :)
Аз няма да давам код, защото колегите по-горе вече са ти го оправили. :)
 
Благодаря Nazi_93 :) благодаря на всички жалко че не може да дам на тримата +
 
Трябва да си влезнал или регистриран, за да отговориш тук.

Back
Горе