Hi guys,
The idea of this script is to check if the website is under maintenance, and if it is, direct the user to the maintenance page. If the user is signed in, and has privileges to bypass the maintenance page and continue to look at the website, then they won't be redirected, but I can't seem to get it to work? I've checked all the tables in database, I've been through the code multiple times. It's not displaying an error, it's just running through the code and then doing nothing?
(Maintenance has already been set to '1' in the database)
index.php
<?php
include "core.php";
?>
<?
$updatecounter = mysql_query("UPDATE webviews SET count = count+1 WHERE id = '1'");
if (!$updatecounter) {
die ("Can't update the counter : " . mysql_error());
}
?>
core.php
<?php
session_start();
include "config.php";
include "security.php";
$id = $_SESSION['userinfo']['id'];
if ($_SESSION['logged'] == true) {
$qry="SELECT * FROM fuserights WHERE userid='$id'";
$result=mysql_query($qry);
if($result) {
if(mysql_num_rows($result) == 1) {
$checks = mysql_fetch_assoc($result);
$access = $checks['bypassmaintenance'];
}
}
if($access == 1)
{
}else {
$result = mysql_query("SELECT * FROM maintenance") or die(mysql_error());
while($row = mysql_fetch_assoc($result)) {
if($row['check'] == 1) {
header('location:/maintenance/');
}
}
}
}
?>
config.php
<?php
$server = "***";
$username = "***";
$password = "***";
$db_name = "***";
$connect = mysql_connect($server, $username, $password) or die(mysql_error());
mysql_select_db($db_name, $connect) or die(mysql_error());
mysql_query("SET NAMES utf8");
?>
security.php
<?php
$array = array(
"union",
"sql",
"mysql",
"database",
"cookie",
"coockie",
"select",
"from",
"where",
"benchmark",
"concat",
"table",
"into",
"by",
"values",
"exec",
"shell",
"truncate",
"wget",
"/**/",
"1=1",
"xss"
);
foreach ($array as $d) {
$string = security($_SERVER['QUERY_STRING']);
if (strpos(strtolower($string), $d) != false) {
$ip = $_SERVER['REMOTE_ADDR'];
$loc = $_SERVER['PHP_SELF'];
$browseros = $_SERVER['HTTP_USER_AGENT'];
$oslanguage = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
$date = date("d.m.Y / H:i:s");
$file = security('' . $loc . '?' . $string . '');
$type = "SQL Injection";
$queryvalid = mysql_query("SELECT * FROM `hacker-attacks` WHERE file='$file' and type='SQL Injection' LIMIT 1");
$validator = mysql_num_rows($queryvalid);
if ($validator > "0") {
echo '<meta http-equiv="refresh" content="0;url=index.php" />';
exit();
} else {
$log = "INSERT INTO `hacker-attacks` (ip, date, file, type, browseros, oslanguage) VALUES ('$ip', '$date', '$file', '$type', '$browseros', '$oslanguage')";
$result = mysql_query($log);
echo '<meta http-equiv="refresh" content="0;url=index.php" />';
exit();
}
}
}
function security($input)
{
$input = mysql_real_escape_string($input);
$input = strip_tags($input);
$input = stripslashes($input);
return $input;
}
$guestip = $_SERVER['REMOTE_ADDR'];
$querybanned = mysql_query("SELECT * FROM `bans` WHERE ip='$guestip'");
$banned = mysql_num_rows($querybanned);
$row = mysql_fetch_array($querybanned);
$reason = $row['reason'];
if ($banned > "0") {
die("<center><font size='7' color='red'><b>You are banned</b></font><br>
Reason: $reason<br> <br /><img src='images/banned.png' /></center>");
}
?>
Any help would be appreciated!
Thanks.
