Jump to content

CroNiX

Staff Alumni
  • Posts

    1,469
  • Joined

  • Last visited

  • Days Won

    12

Posts posted by CroNiX

  1. The From: header should always be from from the actual account on the server sending the email, in this case "me@gmail.com" since that's really where the email is being sent FROM. If they don't match, most, if not all, of the more reputable ISPs will flag it as spam or worse, just not deliver it. It could also be why google is sending you that message.

     

    There is nothing in your PHP to be able to know if it will "work fine with js validation". That's all done clientside, in the HTML, which you haven't shown us.

  2. You send the request to the script that ajax would normally be submitting the login info to. It doesn't need to be an "ajax" request, unless they are specifically looking for the XMLHttpRequest header in which case you'd just need to add it to the CURL header to simulate an ajax request.

    Something like:

    curl_setopt($ch, CURLOPT_HTTPHEADER, array("X-Requested-With: XMLHttpRequest", "Content-Type: application/json; charset=utf-8"));
  3. It's good that you are using prepared statements.  There are 2 things I would change though:

    1) Store your db credentials in a separate file, and then include it on any page you use the db on. This way if the info changes, you just update one file instead of all files that you use db in. You might also just include the $link statement there too.

    2) Don't output db errors to the screen, unless this is only for development server. This exposes info about your db and structure that might be useful to a malicious user. It also does the user absolutely no good to know about your db errors. Log them to a file or send an email with the error or something, and just let the user know "an error occurred" or something more generic.

  4. There are a lot of things that can cause that mysql error (10048) if you google it. It has nothing to do with xampp. It has to do with the mysql server. Did you try rebooting your machine? It could even be a registry setting in windows dealing with TCP ports.

  5. That would really depend on the individual coders skills, knowledge, and whether it's being coded from scratch or using some framework/library.  I believe that any modern language would take about the same to develop the same thing in another modern language, but again, it depends on the coder. If you were comparing assembly language to php, that's a bit different as one is a very low level language and the other is fairly high, comparatively speaking.

  6. .htaccess also cascades, so it will affect the dir it is in and any subdirs of that dir.  So it would also be possible to have another dir with php below the dir with .htaccess and .htaccess wont come into play for that request.

     

    @jazzman1 yes, I agree .htaccess can also be bypassed via CLI. My earlier comment was directed at the OP's remark about having the request processed before .htaccess, which you can't do if accessing via a http request unless .htaccess is in a different dir.

     

    Although I don't think any of these ways are really a good solution for the "git 2 factor authentication" issue. HTTP_BASIC_AUTH might be a better way to go, and you can create the htpasswd file via a php backend if it needs to be dynamic. Then they can get access by user:pass@host.com if they are authorized.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.