waynew Posted November 4, 2008 Share Posted November 4, 2008 Forgive me if it is slow at times. It's on a test shared server that isn't reliable for its db connection speed. http://mytestserver.net78.net/index.php Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/ Share on other sites More sharing options...
Maq Posted November 4, 2008 Share Posted November 4, 2008 Do you have a demo login we should use? Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682097 Share on other sites More sharing options...
waynew Posted November 4, 2008 Author Share Posted November 4, 2008 Username: Tester Password: Tester Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682099 Share on other sites More sharing options...
waynew Posted November 4, 2008 Author Share Posted November 4, 2008 Give me a second. I have to sort something that I missed out when creating it Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682100 Share on other sites More sharing options...
waynew Posted November 4, 2008 Author Share Posted November 4, 2008 Fixed. I had forgot to create the updates table on the test server. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682102 Share on other sites More sharing options...
darkfreaks Posted November 4, 2008 Share Posted November 4, 2008 XSS on register.php DOM was modified by attack string. Field appears to be very vulnerable to XSS String. Tested value: <SCRIPT>document.vulnerable=true;</SCRIPT> Attack Details: _POST day ,_POST month Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682105 Share on other sites More sharing options...
waynew Posted November 4, 2008 Author Share Posted November 4, 2008 Hm, if(isset($_POST['register'])){ echo "<option value=\"".htmlentities($_POST['day'])."\" selected>".htmlentities($_POST['day'])."</option>"; } Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682112 Share on other sites More sharing options...
Maq Posted November 4, 2008 Share Posted November 4, 2008 Those credentials aren't working...at least in all lower-case. Is it case sensitive? Because I've used up my 3 attempts and can't try again. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682135 Share on other sites More sharing options...
waynew Posted November 4, 2008 Author Share Posted November 4, 2008 Lol yes, the password was case sensitive. The username isn't. New login: username: testing password: testing Password is case sensitive. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682448 Share on other sites More sharing options...
Coreye Posted November 4, 2008 Share Posted November 4, 2008 I tried to upload a .png image but it just says "Images can only be jpg,jpeg or png". Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682482 Share on other sites More sharing options...
waynew Posted November 4, 2008 Author Share Posted November 4, 2008 Sorry. I should have changed the error message. I'm only allowing jpg or gifs. Discrepancy noted. Thanks. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682528 Share on other sites More sharing options...
darkfreaks Posted November 5, 2008 Share Posted November 5, 2008 might want to use strip_tags on month/day/year/gender other than that i have nothing. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-682585 Share on other sites More sharing options...
corbin Posted November 5, 2008 Share Posted November 5, 2008 When you submit a ' in fields on forms, they're spit back to you as \'. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-683254 Share on other sites More sharing options...
waynew Posted November 6, 2008 Author Share Posted November 6, 2008 When you submit a ' in fields on forms, they're spit back to you as \'. Magic quotes. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-684129 Share on other sites More sharing options...
corbin Posted November 6, 2008 Share Posted November 6, 2008 Magic quotes suck. I would disable them or cancel them out personally. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-684150 Share on other sites More sharing options...
waynew Posted November 7, 2008 Author Share Posted November 7, 2008 Oh I know. The server that it will be launched on won't have magic quotes. Thank God. All data that goes into the database is stripped of slashes if magic quotes is enabled. So, I have a bit of a fail safe. I should probably also add it to my output filter. But that might strip slashes that were intentionally put there. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-684472 Share on other sites More sharing options...
corbin Posted November 8, 2008 Share Posted November 8, 2008 Why not strip the slashes from the $_GET, $_POST, $_COOKIE arrays if get_magic_quotes_gpc() is true? (At the beginning of each script.) Then, it's basically like magic quotes is off. Or, just disable magic quotes through htaccess. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-684959 Share on other sites More sharing options...
waynew Posted November 8, 2008 Author Share Posted November 8, 2008 That's what I have been using. However, say for example, when the user fails to register, I have to ouput their POST variables back into their designated fields so that the user doesn't have to refill everything. My input filter goes a little like: if(get_magic_quotes_gpc() == 1){ $string = stripslashes($string); } However, those slashes aren't stripped if POST variables are being returned straight back to the page because of an error. Only data that is good to go and allowed into the db gets stripped. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-684974 Share on other sites More sharing options...
darkfreaks Posted November 8, 2008 Share Posted November 8, 2008 Fixed Code: <?php //turn magic quotes off ini_set("magic_quotes_gpc", "0"); set_magic_quotes_runtime(1); function stripper($stringvar){ if (1 == get_magic_quotes_gpc()){ $stringvar = stripslashes($stringvar); } return $stringvar; ?> Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-685081 Share on other sites More sharing options...
waynew Posted November 8, 2008 Author Share Posted November 8, 2008 The site that it will be on wont have magic quotes so I'm not too worried. Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-685341 Share on other sites More sharing options...
waynew Posted November 16, 2008 Author Share Posted November 16, 2008 Anything for a usability point of view? Link to comment https://forums.phpfreaks.com/topic/131350-custom-social-network/#findComment-691290 Share on other sites More sharing options...
Recommended Posts