Jump to content

Test Security Please - NON-DESTRUCTIVE

skiingguru1611

By skiingguru1611
in Beta Test Your Stuff!

 Share

Recommended Posts

  • Replies 114
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

skiingguru1611 Newbie

skiingguru1611

Posted
  • Author
Posted

This is the current code for insert.php, do you see anything wrong with it?

 

 

<?php include("../Login/include/session.php");?>
<?php include("../Login/function.php");?>
<?php
$username="***";
$password="***";
$database="***";

$coach="$user";

$first=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['first']))));
$last=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['last']))));
$title=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['title']))
$college=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['college']))));
$division=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['division']))));
$phone=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['phone']))));
$cell=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['cell']))));
$email=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['email']))));

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = "INSERT INTO coach (id, first, last, title, college, division, phone, cell, email) VALUES ('','$first','$last','$title','$college','$division','$phone','$cell','$email')";
mysql_query($query); 

mysql_close();
?>

Link to comment
Share on other sites
darkfreaks Advanced Member

darkfreaks

Posted
Posted 
<?php include("../Login/include/session.php");?>
<?php include("../Login/function.php");?>
<?php
$username="***";
$password="***";
$database="***";

$coach="$user";

$first=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['first']))));
$last=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['last']))));
$title=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['title']))
$college=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['college']))));
$division=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['division']))));
$phone=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['phone']))));
$cell=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['cell']))));
$email=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['email']))));

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
if(!empty($first)||!empty($last)||!empty($title)||!empty($college)||!empty($division)||!empty($phone)||!empty($cell)||!empty($email)){
$query = "INSERT INTO coach (id, first, last, title, college, division, phone, cell, email) VALUES ('','$first','$last','$title','$college','$division','$phone','$cell','$email')";
mysql_query($query); 
} else{
echo "please go back and fill out the form";}

mysql_close();
?>

Link to comment
Share on other sites
darkfreaks Advanced Member

darkfreaks

Posted
Posted

Parse error: syntax error, unexpected T_VARIABLE in /home/tullyl00/domains/tullycornfieldclassic.com/public_html/insert.php on line 13

 

 

and you wonder why your  function isnt working  ;D

 

but i noticed

 

$title=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['title']))

 

should be:

$title=RemoveXSS(trim(strip_tags(mysql_real_escape_string($_POST['title']));

 

that should fix insert.php ;)

 

also you have a problem with your admin.php can you post code for that? :-\

Link to comment
Share on other sites
skiingguru1611 Newbie

skiingguru1611

Posted
  • Author
Posted

Don't worry about admin.php, no one will be able to get on it, I'm going to secure that. (It's actually someone else's script, and I just edited the database info.)

 

But, I'm pretty sure its 4 closed paran not just 3 for insert.php, regardless I fixed that, and uploaded it to the server.

 

Can you check that hopefully one last time?

Link to comment
Share on other sites
skiingguru1611 Newbie

skiingguru1611

Posted
  • Author
Posted

It's pretty big but here is admin.php...I didn't make this, so you will have to help me out quite a bit probably.

 

<?php 

/*
Author - Ofri Markus
Date   - 3/12/03

This is a generic script to view and modify mysql databases.
All you need to do to use this script is:
1. Put it in your site, and call the file "admin.php".
2. Fill in the connection details on the first line, replace DB_USER AND DB_PASSWORD.
3. Fill in the database name on 2 lines, replace DB_NAME.

The advantage of this script is that is you don't need to 
modify it to your own scheme. it will work on any scheme.

I would be happy to receive comments and improved versions of 
this script to:

markus_ofri@hotmail.com

Enjoy!

*/

// Initial connection to the database
$database = mysql_connect("localhost", "***", "****");
mysql_select_db("****");

// Because the first time we enter the site we have'nt selected
// a table to view we init the number of rows in the current table
$rowNum=0;

?>

<html>
<body bgcolor="#ffffff">

<?php

// Get the data of the tables on the scheme
$result = mysql_list_tables ("****");

$i=0;
while ($i < mysql_num_rows ($result)) 
{
$tb_names[$i] = mysql_tablename ($result, $i);$i++;
}

// Check if we got here after pressing submit on the page
if (isset($_POST['submit']))
{
   // If we did press the submit button, we sould view the table that was on the select
   // box
   $submit=$_POST['submit'];
   $table=$_POST['table'];
}
else
{
// If we didn't get here after pressing the submit button, check if we already
// viewed one of the tables (and saved it's name on the hidden field hidtable
   	if (isset($_POST['hidtable']))
{
	$table = $_POST['hidtable'];
}
else
{
	$table="<i>not selected</i>";$xnum=0;
}
}

?>

<center>
<form name=ff method=post action="/admin.php">
<b>Select table</b>:<select name="table">
<?php 
for($x=0;$x<$i;$x++)
{?>
<option value="<? echo $tb_names[$x];?>" <? if (isset($table) && $table==$tb_names[$x]) {echo " selected ";} ?>><? echo $tb_names[$x];?></option>
<?php }?>
</select>
<input type="submit" name="submit" value="submit">



<?php 

// Check if we pressed the submit button and if we did - fetch the table data
if(isset($submit) || isset($_POST['hidtable'])){
$SQL="SELECT * FROM hidtable";
$result = mysql_query($SQL);


// Read all the data in the table
for ($j = 0; $j<$rowNum; ++$j) 
{
$row = mysql_fetch_array($result);
$currTable[$j]=$row;
}
}




?>



  <p> </p>

<br>

<?php

// Check to see if there was an update to a row
for ($j = 0; $j<$rowNum; ++$j) 
{
    if (isset($_POST["update".$j]))
    {
	// Make an sql update query
        echo "<center>There was an update to row $j</center>";
        $sql="update $table set ";
        for ($i = 0; $i < $xnum; ++$i)
        {
		if ($numeric[$i]==1)
		{
            $sql.=$name[$i]."=".$_POST["$name[$i]".$j]." ";
		}
		else
		{
    	        $sql.=$name[$i]."='".$_POST["$name[$i]".$j]."' ";			
		}

		if ($i != $xnum-1) {$sql.=",";}
        }
        $sql.="WHERE ";
	$notFirstKey = 0;
    for ($i = 0; $i < $xnum; ++$i)
        {	
		if ($key[$i]==1)
		{
			if ($notFirstKey == 0) {$notFirstKey=1;}
			else {$sql.=" AND ";}
            	$sql.=$name[$i]."=".$currTable[$j][$i];

		}

        }
	if ($notFirstKey == 0) {
		echo "Table does not have a primary key, not doing anything";
	}
	else {
  		echo $sql;
        $result = mysql_query($sql);
	}

        
    }
}

// Check to see if there was a delete to a row
for ($j = 0; $j<$rowNum; ++$j) 
{
    if (isset($_POST["delete".$j]))
    {
        echo "<center>There was an delete to row $j</center>";
        $sql="delete from $table ";
        $sql.="WHERE ";
	$notFirstKey = 0;
    for ($i = 0; $i < $xnum; ++$i)
        {	
		if ($key[$i]==1)
		{
			if ($notFirstKey == 0) {$notFirstKey=1;}
			else {$sql.=" AND ";}
            	$sql.=$name[$i]."=".$currTable[$j][$i];

		}

        }
	if ($notFirstKey == 0) {
		echo "Table does not have a primary key, not doing anything";
	}
	else {
  		echo $sql;
        $result = mysql_query($sql);
	}
        
    }
}

// Check to see if there was an insert of a row
    if (isset($_POST["insert"]))
    {
        echo "<center>There was an insert of a row </center>";
        $sql="insert into $table values (";
        for ($i = 0; $i < $xnum; ++$i)
        {
        $sql.="'".$_POST["$name[$i]"."insert"]."' ";
		if ($i != $xnum-1) {$sql.=",";}
        }
        $sql.=")";
  		echo $sql;
        $result = mysql_query($sql);
        
    }




///////////////







if(isset($submit) || isset($_POST['hidtable'])){
$SQL="SELECT * FROM $table";
$result = mysql_query($SQL);
$xnum = mysql_num_fields($result); 
$rowNum = mysql_num_rows($result); 

}

?>




<center>
<table bgcolor=black>
<tr>
<?php
for ($i=0; $i<$xnum; ++$i)
{
$name[$i]=mysql_field_name($result,$i);
?>
<td bgcolor="#e3e3e3"><? echo $name[$i]; ?></td>	
<?php } ?>
</tr>

<?php for ($j = 0; $j<$rowNum; ++$j) 
{
$row = mysql_fetch_array($result);
$currTable[$j]=$row;
}
?>


<?php for ($j = 0; $j<$rowNum; ++$j) 
{
?>
<tr>
<?php for ($i=0; $i<$xnum; ++$i)
{
?>
<td><input name=<? echo "\"$name[$i]".$j."\""; ?> type="text" id=<? echo "\"$name[$i]\""; ?> value=<? $currRow=$currTable[$j]; echo "\"$currRow[$i]\""; ?>></td>

<?php } ?>
<td><input type="submit" name=<? echo "\"update".$j."\""; ?> value=<? echo "\"update\""; ?> height="10">
    <input type="submit" name=<? echo "\"delete".$j."\""; ?> value=<? echo "\"delete\""; ?> height="10">
</td>
</tr>
<?php } 
for ($i=0; $i<$xnum; ++$i)
{
?>
<td><input name=<? echo "\"$name[$i]"."insert\""; ?> type="text" id=<? echo "\"$name[$i]\""; ?>></td>

<?php } ?>

<td><input type="submit" name="insert" value="insert"></td>




</table>

</center>
<input type="hidden" name="hidtable" value=<? echo "\"$table\""; ?>>


</form>
</center>
</body>
</html>

Link to comment
Share on other sites
darkfreaks Advanced Member

darkfreaks

Posted
Posted 
<?php 

/*
Author - Ofri Markus
Date   - 3/12/03

This is a generic script to view and modify mysql databases.
All you need to do to use this script is:
1. Put it in your site, and call the file "admin.php".
2. Fill in the connection details on the first line, replace DB_USER AND DB_PASSWORD.
3. Fill in the database name on 2 lines, replace DB_NAME.

The advantage of this script is that is you don't need to 
modify it to your own scheme. it will work on any scheme.

I would be happy to receive comments and improved versions of 
this script to:

markus_ofri@hotmail.com

Enjoy!

*/

// Initial connection to the database
$database = mysql_connect("localhost", "", "");
mysql_select_db("");

// Because the first time we enter the site we have'nt selected
// a table to view we init the number of rows in the current table
$rowNum=0;

?>

<html>
<body bgcolor="#ffffff">

<?php

// Get the data of the tables on the scheme
$result = mysql_list_tables ("");

$i=0;
while ($i < mysql_num_rows ($result)) 
{
$tb_names[$i] = mysql_tablename ($result, $i);$i++;
}

// Check if we got here after pressing submit on the page
if (isset($_POST['submit']))
{
   // If we did press the submit button, we sould view the table that was on the select
   // box
   $submit=$_POST['submit'];
   $table=$_POST['table'];
}
else
{
// If we didn't get here after pressing the submit button, check if we already
// viewed one of the tables (and saved it's name on the hidden field hidtable
   	if (isset($_POST['hidtable']))
{
	$table = $_POST['hidtable'];
}
else
{
	$table="<i>not selected</i>";$xnum=0;
}
}

?>

<center>
<form name=ff method=post action="/admin.php">
<b>Select table</b>:<select name="table">
<?php 
for($x=0;$x<$i;$x++)
{?>
<option value="<? echo $tb_names[$x];?>" <? if (isset($table) && $table==$tb_names[$x]) {echo " selected ";} ?>><? echo $tb_names[$x];?></option>
<?php }?>
</select>
<input type="submit" name="submit" value="submit">



<?php 

// Check if we pressed the submit button and if we did - fetch the table data
if(isset($submit) || isset($_POST['hidtable'])){
$SQL="SELECT * FROM hidtable";
$result = mysql_query($SQL);
$rowNum = mysql_num_rows($result); 
$xnum = mysql_num_fields($result);


// Read all the data in the table
for ($j = 0; $j<$rowNum; ++$j) 
{
$row = mysql_fetch_array($result);
$currTable[$j]=$row;
}
}




?>



  <p> </p>

<br>

<?php

// Check to see if there was an update to a row
for ($j = 0; $j<$rowNum; ++$j) 
{
    if (isset($_POST["update".$j]))
    {
	// Make an sql update query
        echo "<center>There was an update to row $j</center>";
        $sql="update $table set ";
        for ($i = 0; $i < $xnum; ++$i)
        {
		if ($numeric[$i]==1)
		{
            $sql.=$name[$i]."=".$_POST["$name[$i]".$j]." ";
		}
		else
		{
    	        $sql.=$name[$i]."='".$_POST["$name[$i]".$j]."' ";			
		}

		if ($i != $xnum-1) {$sql.=",";}
        }
        $sql.="WHERE ";
	$notFirstKey = 0;
    for ($i = 0; $i < $xnum; ++$i)
        {	
		if ($key[$i]==1)
		{
			if ($notFirstKey == 0) {$notFirstKey=1;}
			else {$sql.=" AND ";}
            	$sql.=$name[$i]."=".$currTable[$j][$i];

		}

        }
	if ($notFirstKey == 0) {
		echo "Table does not have a primary key, not doing anything";
	}
	else {
  		echo $sql;
        $result = mysql_query($sql);
	}

        
    }
}

// Check to see if there was a delete to a row
for ($j = 0; $j<$rowNum; ++$j) 
{
    if (isset($_POST["delete".$j]))
    {
        echo "<center>There was an delete to row $j</center>";
        $sql="delete from $table ";
        $sql.="WHERE ";
	$notFirstKey = 0;
    for ($i = 0; $i < $xnum; ++$i)
        {	
		if ($key[$i]==1)
		{
			if ($notFirstKey == 0) {$notFirstKey=1;}
			else {$sql.=" AND ";}
            	$sql.=$name[$i]."=".$currTable[$j][$i];

		}

        }
	if ($notFirstKey == 0) {
		echo "Table does not have a primary key, not doing anything";
	}
	else {
  		echo $sql;
        $result = mysql_query($sql);
	}
        
    }
}

// Check to see if there was an insert of a row
    if (isset($_POST["insert"]))
    {
        echo "<center>There was an insert of a row </center>";
        $sql="insert into $table values (";
        for ($i = 0; $i < $xnum; ++$i)
        {
        $sql.="'".$_POST["$name[$i]"."insert"]."' ";
		if ($i != $xnum-1) {$sql.=",";}
        }
        $sql.=")";
  		echo $sql;
        $result = mysql_query($sql);
        
    }




///////////////







if(isset($submit) || isset($_POST['hidtable'])){
$SQL="SELECT * FROM $table";
$result = mysql_query($SQL);
$xnum = mysql_num_fields($result); 
$rowNum = mysql_num_rows($result); 

}

?>

Link to comment
Share on other sites
skiingguru1611 Newbie

skiingguru1611

Posted
  • Author
Posted

Also, please take out the code from your previous post..you saw the code before I took out the server password and username.  I don't want anyone seeing that.

 

I get these errors, with the code you gave me.

 

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/tullyl00/domains/tullycornfieldclassic.com/public_html/admin.php on line 92

Warning: mysql_num_fields(): supplied argument is not a valid MySQL result resource in /home/tullyl00/domains/tullycornfieldclassic.com/public_html/admin.php on line 93

Link to comment
Share on other sites
darkfreaks Advanced Member

darkfreaks

Posted
Posted

done ;)

 

also next time please be sure to connect to the database when using a new PHP tags  ;)

 

<?php 

/*
Author - Ofri Markus
Date   - 3/12/03

This is a generic script to view and modify mysql databases.
All you need to do to use this script is:
1. Put it in your site, and call the file "admin.php".
2. Fill in the connection details on the first line, replace DB_USER AND DB_PASSWORD.
3. Fill in the database name on 2 lines, replace DB_NAME.

The advantage of this script is that is you don't need to 
modify it to your own scheme. it will work on any scheme.

I would be happy to receive comments and improved versions of 
this script to:

markus_ofri@hotmail.com

Enjoy!

*/

// Initial connection to the database
$database = mysql_connect("localhost", "", "");
mysql_select_db("tullyl00_corn");

// Because the first time we enter the site we have'nt selected
// a table to view we init the number of rows in the current table
$rowNum=0;

?>

<html>
<body bgcolor="#ffffff">

<?php

// Get the data of the tables on the scheme
$result = mysql_list_tables ("");

$i=0;
while ($i < mysql_num_rows ($result)) 
{
$tb_names[$i] = mysql_tablename ($result, $i);$i++;
}

// Check if we got here after pressing submit on the page
if (isset($_POST['submit']))
{
   // If we did press the submit button, we sould view the table that was on the select
   // box
   $submit=$_POST['submit'];
   $table=$_POST['table'];
}
else
{
// If we didn't get here after pressing the submit button, check if we already
// viewed one of the tables (and saved it's name on the hidden field hidtable
   	if (isset($_POST['hidtable']))
{
	$table = $_POST['hidtable'];
}
else
{
	$table="<i>not selected</i>";$xnum=0;
}
}

?>

<center>
<form name=ff method=post action="/admin.php">
<b>Select table</b>:<select name="table">
<?php 
for($x=0;$x<$i;$x++)
{?>
<option value="<? echo $tb_names[$x];?>" <? if (isset($table) && $table==$tb_names[$x]) {echo " selected ";} ?>><? echo $tb_names[$x];?></option>
<?php }?>
</select>
<input type="submit" name="submit" value="submit">



<?php 

// Check if we pressed the submit button and if we did - fetch the table data
if(isset($submit) || isset($_POST['hidtable'])){
$database = mysql_connect("localhost", "", "");
mysql_select_db("");
$SQL="SELECT * FROM hidtable";
$result = mysql_query($SQL);
$rowNum = mysql_num_rows($result); 
$xnum = mysql_num_fields($result);


// Read all the data in the table
for ($j = 0; $j<$rowNum; ++$j) 
{
$row = mysql_fetch_array($result);
$currTable[$j]=$row;
}
}




?>



  <p> </p>

<br>

<?php

// Check to see if there was an update to a row
for ($j = 0; $j<$rowNum; ++$j) 
{
    if (isset($_POST["update".$j]))
    {
	// Make an sql update query
        echo "<center>There was an update to row $j</center>";
        $sql="update $table set ";
        for ($i = 0; $i < $xnum; ++$i)
        {
		if ($numeric[$i]==1)
		{
            $sql.=$name[$i]."=".$_POST["$name[$i]".$j]." ";
		}
		else
		{
    	        $sql.=$name[$i]."='".$_POST["$name[$i]".$j]."' ";			
		}

		if ($i != $xnum-1) {$sql.=",";}
        }
        $sql.="WHERE ";
	$notFirstKey = 0;
    for ($i = 0; $i < $xnum; ++$i)
        {	
		if ($key[$i]==1)
		{
			if ($notFirstKey == 0) {$notFirstKey=1;}
			else {$sql.=" AND ";}
            	$sql.=$name[$i]."=".$currTable[$j][$i];

		}

        }
	if ($notFirstKey == 0) {
		echo "Table does not have a primary key, not doing anything";
	}
	else {
  		echo $sql;
        $result = mysql_query($sql);
	}

        
    }
}

// Check to see if there was a delete to a row
for ($j = 0; $j<$rowNum; ++$j) 
{
    if (isset($_POST["delete".$j]))
    {
        echo "<center>There was an delete to row $j</center>";
        $sql="delete from $table ";
        $sql.="WHERE ";
	$notFirstKey = 0;
    for ($i = 0; $i < $xnum; ++$i)
        {	
		if ($key[$i]==1)
		{
			if ($notFirstKey == 0) {$notFirstKey=1;}
			else {$sql.=" AND ";}
            	$sql.=$name[$i]."=".$currTable[$j][$i];

		}

        }
	if ($notFirstKey == 0) {
		echo "Table does not have a primary key, not doing anything";
	}
	else {
  		echo $sql;
        $result = mysql_query($sql);
	}
        
    }
}

// Check to see if there was an insert of a row
    if (isset($_POST["insert"]))
    {
        echo "<center>There was an insert of a row </center>";
        $sql="insert into $table values (";
        for ($i = 0; $i < $xnum; ++$i)
        {
        $sql.="'".$_POST["$name[$i]"."insert"]."' ";
		if ($i != $xnum-1) {$sql.=",";}
        }
        $sql.=")";
  		echo $sql;
        $result = mysql_query($sql);
        
    }




///////////////







if(isset($submit) || isset($_POST['hidtable'])){
$SQL="SELECT * FROM $table";
$result = mysql_query($SQL);
$xnum = mysql_num_fields($result); 
$rowNum = mysql_num_rows($result); 

}

?>

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.