blufish Posted August 1, 2008 Share Posted August 1, 2008 Okay so a couple of weeks ago someone ran a php script on my site, which messed up the homepage. The ran the script through the page creator (allows people to make webpages), I wasn't stripping tags because I wanted to allow html and javascript to be able to get through without any trouble. So the question I wish to ask is if I told my code to delete everything between the "<?php" and "?>" tags what if they just wrote code like: echo "Hello World"; would that code be executed by my program or when someone tried to view the page would it still have the "echo". Essentially what I'm asking is if I display whatever someone writes on my site except for anything they write between the "<?php" and "?>" tags would they still be able to write php code and get it executed? Thanks, Blufish Link to comment https://forums.phpfreaks.com/topic/117653-solved-someone-running-php-on-my-site/ Share on other sites More sharing options...
Andy-H Posted August 1, 2008 Share Posted August 1, 2008 Just tested it, <?php $var = htmlspecialchars($_POST['var']); if ($_POST['submit']){ echo ''.$var.''; } ?> <html> <head> </head> <body> <form method="post"> <textarea name="var" rows="5" cols="30"></textarea><br /> <input type="submit" name="submit" /> </form> </body> </html> That works fine for me. Link to comment https://forums.phpfreaks.com/topic/117653-solved-someone-running-php-on-my-site/#findComment-605146 Share on other sites More sharing options...
Andy-H Posted August 1, 2008 Share Posted August 1, 2008 So basically use htmlspecialchars and annotate the variable before displaying it. Link to comment https://forums.phpfreaks.com/topic/117653-solved-someone-running-php-on-my-site/#findComment-605148 Share on other sites More sharing options...
Andy-H Posted August 1, 2008 Share Posted August 1, 2008 You would also need to use stripslashes(), sorry about the 3 replies for one answer I'm just testing it on my db lol Link to comment https://forums.phpfreaks.com/topic/117653-solved-someone-running-php-on-my-site/#findComment-605149 Share on other sites More sharing options...
blufish Posted August 1, 2008 Author Share Posted August 1, 2008 Thank you! Link to comment https://forums.phpfreaks.com/topic/117653-solved-someone-running-php-on-my-site/#findComment-605159 Share on other sites More sharing options...
Andy-H Posted August 1, 2008 Share Posted August 1, 2008 Check your messages please. Link to comment https://forums.phpfreaks.com/topic/117653-solved-someone-running-php-on-my-site/#findComment-605163 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.