Lamez

-foot_bowls id name pnt_val team_a team_b image date time network place rank_a rank_b rec_a rec_b -foot_teams confer team -foot_picks id bowl_name team user

I have made a website for a client. I was only paid to create the design, not the content. Anyways, I would like for you guys to find any exploits that are in it. here is a link: http://yorkielicious.com/index.php

you need to have the value as a hidden value. Say you have a input form, then take that input form data and hide it as a hidden value, then keep it until needed. Understand?

use exit;

like my entire database, or just those two tables?

Oops your right thanks! I never have and it seems to work. Otherwise I have to write </option> over and over Its good programming habits. You always close an open tag. Its like leaving your front door open, once you are in then you close the door. So close your tags!

your id type should be int

no clue? Would I need to use a inner join? if so how?

Ok, I am trying to order the information that is being displayed by the way it went in, well information in a different table, with the users team pick, and the bowl name, have no organization at all, However the other table does. Example: -Table: foot_bowls id bowl name team_a team_b -Table: foot_picks bowl_name team user so really, my question is this, how can I take the id from the foot_bowls, and use it to order my other query? My Code: <?php ob_start(); $path = "../../"; $title = "Change Your Picks!"; $rank = "yes"; $u_login = "yes"; $ban = "yes"; include ($path."main/include/cons/head.php"); if(siteStat() !== "Football"){ header ("Location: ../index.php"); } $ck = mysql_query("SELECT `user` FROM `foot_picks` WHERE `user` = '".$user_."' LIMIT 1"); $ck = mysql_num_rows($ck); if($ck == 0){ header("Location: ../index.php"); } $num = 0; echo '<p class="header">'.$title.'</p><p class="maintext"><form action="ch_pks_proc.php" method="post" name="pks" id="pks">'; $v = mysql_query("SELECT * FROM `foot_picks` WHERE `user` = '".$user_."'")or die(mysql_error()); while($n = mysql_fetch_array($v)){ $nt = $n['team']; $a = mysql_query("SELECT * FROM `foot_bowls` WHERE `team_a` = '".$nt."' OR `team_b` = '".$nt."'")or die(mysql_error()); $b = mysql_fetch_array($a); $team_a = $b['team_a']; $team_b = $b['team_b']; $name = $b['name']; $pnt_val = $b['pnt_val']; $find_a = mysql_query("SELECT `confer` FROM `foot_teams` WHERE '".$team_a."' = `team`")or die(mysql_error()); $con_a = mysql_fetch_array($find_a); $find_b = mysql_query("SELECT `confer` FROM `foot_teams` WHERE `team` = '".$team_b."'"); $con_b = mysql_fetch_array($find_b); $confer_a = $con_a['confer']; $confer_b = $con_b['confer']; $img_a = $path."main/style/img/Helmets/".$confer_a."/".$team_a.".jpeg"; $img_b = $path."main/style/img/Helmets/".$confer_b."/".$team_b.".jpeg"; if($team_a == $nt){ $team_ab = "<b>".$team_a."</b>"; $team_bb = $team_b; $sa = 'checked="checked"'; $sb = ""; } if($team_b == $nt){ $team_bb = "<b>".$team_b."</b>"; $team_ab = $team_a; $sb = 'checked="checked"'; $sa = ""; } $num+=1; ?> <table width="100%" border="0"> <tr> <td width="7%">Bowl Name: </td> <td width="47%"><b><?php echo $name ?></b> <input name="name-<?php echo $num; ?>" type="hidden" id="name-<?php echo $num; ?>" value="<?php echo $name; ?>" /></td> <td width="7%">Point Value: </td> <td width="39%"><?php echo $pnt_val; ?></td> </tr> <tr> <td colspan="2" align="center" valign="top"><img alt="<?php echo $team_a; ?>" src="<?php echo $img_a; ?>" border="0" /></td> <td colspan="2" align="center" valign="top"><img alt="<?php echo $team_b; ?>" src="<?php echo $img_b; ?>" border="0" /></td> </tr> <tr> <td colspan="2" align="center" valign="top"><?php echo $b['rank_a']." ".$team_ab." (".$b['rec_a'].")"; ?></td> <td colspan="2" align="center" valign="top"><?php echo $b['rank_b']." ".$team_bb." (".$b['rec_b'].")"; ?></td> </tr> <tr> <td colspan="2" align="center" valign="top"><input name="team-<?php echo $num; ?>" type="radio" value="<?php echo $team_a; ?>" <?php echo $sa; ?> /></td> <td colspan="2" align="center" valign="top"><input name="team-<?php echo $num; ?>" type="radio" value="<?php echo $team_b; ?>" <?php echo $sb; ?> /></td> </tr> </table> <hr /> <?php }//end while loop echo '<input type="submit" name="Submit" value="Submit" /></form></p>'; include ($path."main/include/cons/foot.php"); ?>

awesome-tastic!

is it possible to have two where clauses in a update query? $query = "UPDATE `foot_picks` SET `bowl_name` = '".$name."', `team` = '".$team."' WHERE `user` = '".$username."' AND WHERE `bowl_name` = '".$name."'";

are you a Java programmer?

here is what you can do, is make a php script to log IPs into a database, then go and find some proxys, and visit the script with the proxy, then you will have a DB full of proxys' of ips.

wow, that fixed it

The script below is suppose to find the user's pick, as in a football team, then take that info and pull the who the team is playing. so like, say the user chose, Texas Tech, then it finds who they are playing, so it would be Ole Miss. Well, it is not finding who the other team is. It does find who the user picked. Here is the script: <?php ob_start(); $path = "../../"; $title = "Choose your Teams!"; $rank = "yes"; $u_login = "yes"; $ban = "yes"; include ($path."main/include/cons/head.php"); if(siteStat() !== "Football"){ header ("Location: ../index.php"); } $ck = mysql_query("SELECT `user` FROM `foot_picks` WHERE `user` = '".$user_."' LIMIT 1"); $ck = mysql_num_rows($ck); if($ck == 0){ header("Location: ../index.php"); } $v = mysql_query("SELECT * FROM `foot_picks` WHERE `user` = '".$user_."'")or die(mysql_error()); while($n = mysql_fetch_array($v)){ $nt = $n['team']; $a = mysql_query("SELECT * FROM `foot_bowls` WHERE `team_a` OR `team_b` = '".$nt."'")or die(mysql_error()); $b = mysql_fetch_array($a); $team_a = $b['team_a']; $team_b = $b['team_b']; echo $team_a." VS ".$team_b."<br>"; } include ($path."main/include/cons/foot.php"); ?>

ya, I caught that before I went to bed, I was so happy. Well in fact my dad caught it, and it does not know PHP.

<table width="100%" border="0"> <tr> <td width="7%">Bowl Name: </td> <td width="47%"><?php echo $f['name']; ?> <?php $name = $f['name']; ?> <input name="name-<?php echo $num; ?>" type="hidden" id="name-<?php echo $num; ?>" value="<?php echo $name; ?>" /></td> <td width="7%">Point Value: </td> <td width="39%"><?php echo $f['pnt_val']; ?></td> </tr> <tr> <td colspan="2" align="center" valign="top"><img alt="<?php $team_a; ?>" src="<?php echo $img_a; ?>" border="0" /></td> <td colspan="2" align="center" valign="top"><img alt="<?php $team_b; ?>" src="<?php echo $img_b; ?>" border="0" /></td> </tr> <tr> <td colspan="2" align="center" valign="top"><?php echo f['rank_a']." ".$team_a."(".$f['rec_a'].")"; ?></td> <td colspan="2" align="center" valign="top"><?php echo f['rank_b']." ".$team_b."(".$f['rec_b'].")"; ?></td> </tr> <tr> <td colspan="2" align="center" valign="top"><input name="team-<?php echo $num; ?>" type="radio" value="<?php echo $team_a; ?>" checked /></td> <td colspan="2" align="center" valign="top"><input name="team-<?php echo $num; ?>" type="radio" value="<?php echo $team_b; ?>" /></td> </tr> </table>

I cannot find the error in these lines, can you? here is the error: Parse error: syntax error, unexpected '[', expecting ',' or ';' in /var/www/krazypicks/user/foot/index.php on line 49 <td colspan="2" align="center" valign="top"><?php echo f['rank_a']." ".$team_a."(".$f['rec_a'].")"; ?></td> <td colspan="2" align="center" valign="top"><?php echo f['rank_b']." ".$team_b."(".$f['rec_b'].")"; ?></td>

I am trying to upload a image, then resize it. here is my error: Fatal error: Call to undefined function imagecopyresampled() in /var/www/krazypicks/admin_area/foot/new_foot_bowl_proc.php on line 32 here is line 32: $file = "bowls_img/" . $imagepath; //This is the original file here is the entire script: <?php ob_start(); $path = "../../"; $title = "Create Football Bowls"; $rank = "yes"; $u_login = "yes"; $admin = "yes"; include ($path."main/include/cons/head.php"); $counter = $_SESSION['counter']; for ($counter = 1; $counter <= $num; $counter++) { //Image Settings! $imagename = $_FILES['image-'.$counter]['name']; $source = $_FILES['image-'.$counter]['tmp_name']; $target = "bowls_img/".$imagename; move_uploaded_file($source, $target); $imagepath = $imagename; $save = "bowls_img/" . $imagepath; //This is the new file you saving $file = "bowls_img/" . $imagepath; //This is the original file $modwith = $twidth; $modheight = $theight; $tn = imagecreatetruecolor($modwidth, $modheight) ; $image = imagecreatefromjpeg($file) ; imagecopyresampled($tn, $image, 0, 0, 0, 0, $modwidth, $modheight, $width, $height) ; imagejpeg($tn, $save, 100) ; $save = "ibowls_img/sml_" . $imagepath; //This is the new file you saving $file = "bowls_img/" . $imagepath; //This is the original file list($width, $height) = getimagesize($file) ; $modwidth = 80; $diff = $width / $modwidth; $modheight = $height / $diff; $tn = imagecreatetruecolor($modwidth, $modheight) ; $image = imagecreatefromjpeg($file) ; imagecopyresampled($tn, $image, 0, 0, 0, 0, $modwidth, $modheight, $width, $height) ; imagejpeg($tn, $save, 100) ; echo "Large image: <img src='bowls_img/".$imagepath."'><br>"; echo "Thumbnail: <img src='bowls_img/sml_".$imagepath."'>"; echo $name."<br>"; if($name == ("")){ $image = "main/style/img/b_default.jpg"; }else{ $image = "admin_area/foot/bowls_img/".$name; } echo $image; $id = $counter; $name = $_POST['name-'.$counter]; $ta = $_POST['ta-'.$counter]; $tb = $_POST['tb-'.$counter]; $pnt = $_POST['pnt_val'.$counter]; $date = $_POST['date-'.$counter]; $time = $_POST['time-'.$counter]; $network = $_POST['net-'.$counter]; $place = $_POST['place-'.$counter]; $rank_a = $_POST['rna-'.$counter]; $rec_a = $_POST['ra-'.$counter]; $rank_b = $_POST['rnb-'.$counter]; $rec_b = $_POST['rb-'.$counter]; $query = "INSERT INTO `foot_bowls` (id, name, pnt_val, team_a, team_b, image, date, time, network, place, rank_a, rank_b, rec_a, rec_b) VALUES ('".$id."', '".$name."', '".$pnt."', '".$ta."', '".$tb."', '".$image."', '".$date."', '".$time."', '".$network."', '".$place."', '".$rank_a."', '".$rank_b."', '".$rec_a."', '".$rec_b."')"; mysql_query($query)or die(mysql_error()); }//end loop echo "<br>All Done!"; echo "<br>Proccessed ".$id." number of forms"; include ($path."main/include/cons/foot.php"); ?> Any Ideas?

I know this is a stupid question, but I had the ACT today and my brain is fried. I think this would be correct, but if it was, then I would not be posing this. I have a for loop and I have multiple forms and I separate them with a horizontal rule, <hr />, anyways I do not want it on the last one, so I tossed in a if statement, well it did not work. I was wondering if you guys could take a look at it for me. IF Statement: if ($num == $counter){ print '<hr />'; } Entire Code: <?php ob_start(); $path = "../../"; $title = "Create Football Bowls"; $rank = "yes"; $u_login = "yes"; $admin = "yes"; include ($path."main/include/cons/head.php"); $num = $_POST['bowl_num']; for ($counter = 1; $counter <= $num; $counter++) { ?> <form id="form1" name="form1" method="post" action=""> <table width="100%" border="0"> <tr> <td width="6%"> Name: </td> <td width="36%"><label> <input name="b_name" type="text" id="b_name" /> </label></td> <td width="6%">Bowl Img: </td> <td width="52%">IMGIMGIMG</td> </tr> <tr> <td>Date:</td> <td><label> <input name="b_date" type="text" id="b_date" /> </label></td> <td>Time:</td> <td><label> <input name="b_time" type="text" id="b_time" /> </label></td> </tr> <tr> <td>Place:</td> <td><label> <input name="b_place" type="text" id="b_place" /> </label></td> <td>Network:</td> <td><label> <input name="b_net" type="text" id="b_net" /> </label></td> </tr> <tr> <td>Team A:</td> <td><?php $q = mysql_query("SELECT * FROM `foot_teams` ORDER BY `team`"); echo '<select name="ta-'.$counter.'" id="ta-'.$counter.'">'; while ($r = mysql_fetch_array($q)){ if($r['team'] == ($ta)){ echo '<option value="'.$r['team'].'" selected>'.$r['team'].'</option>'; }else{ echo '<option value="'.$r['team'].'">'.$r['team'].'</option>'; } } echo '</select>' ?></td> <td>Record-A:</td> <td><input name="b_rec_a" type="text" id="b_rec_a" /></td> </tr> <tr> <td>Team B:</td> <td><?php $q = mysql_query("SELECT * FROM `foot_teams` ORDER BY `team`"); echo '<select name="tb-'.$counter.'" id="tb-'.$counter.'">'; while ($r = mysql_fetch_array($q)){ if($r['team'] == ($tb)){ echo '<option value="'.$r['team'].'" selected>'.$r['team'].'</option>'; }else{ echo '<option value="'.$r['team'].'">'.$r['team'].'</option>'; } } echo '</select>' ?></td> <td>Record-B:</td> <td><label> <input name="b_rec_b" type="text" id="b_rec_b" /> </label></td> </tr> <tr> <td>Point Val: </td> <td><label> <input name="b_pnt" type="text" id="b_pnt" size="10" /> </label></td> <td>ID:</td> <td><?php echo $counter; ?><input name="id" type="hidden" id="id" value="<?php echo $counter; ?>" /></td> </tr> </table> <?php if ($num == $counter){ print '<hr />'; } } print '</form>'; include ($path."main/include/cons/foot.php"); ?>

thank you so much, that did it

like fgets("path/filename.txt");

I am parsing a text file, and so far so good, but I need help on this next bit. I have a file like so [title]Page Title[/title] [h1]Main Topic[/h1] Rest of my content here. is there a way to read in only the [title][/title] part as a variable, such a $title. Then read in the rest of the file contents. Here is my current code: <?php include ("style/xtra/bbcode.php"); $title = fopen("pages/home.txt", "r"); include ("style/xtra/head.php"); $file = "pages/home.txt"; $f = fopen($file, "r"); while ( $line = fgets($f, 4000) ) { $htmltext = bb2html($line); echo $htmltext; } include ("style/xtra/foot.php"); ?>

lol na, I am done, she likes it.

Well I am sorry, I emailed her, and I asked her about the entire design, and she loved it. The only thing she did not like was the logo, and I already made an "official" logo for her. I was just curious on your guy's thoughts.