subhomoy Posted May 5, 2013 Share Posted May 5, 2013 How can i protect my php source code from being hacked... if i used this type of code in my page.... <?php require_once '../dbconfig.php'; require_once 'header.php'; $adi = $_REQUEST['aid']; $date = date("Y-m-d"); $uid = $_SESSION['user_id1']; $a = mysql_query("SELECT * FROM ad_clk_hits WHERE user_id='$uid' AND date='$date' AND adv_id='$adi'") or die(mysql_error()); if(mysql_num_rows($a)){ echo "<div id='view_ad'> <div id='view_ad_text_error'><img src='images/ebab_mbmcp_ico_6.png' class='error_image' />You have already visited this advertisement today</div> </div>"; } else{ $b = mysql_query("SELECT * FROM ad_clk WHERE id='$adi'") or die(mysql_error()); while ($row = mysql_fetch_array($b)) { $imp = $row['impression']; $link = $row['link']; $money = $row['money']; } $newimp = $imp - 1; $c = mysql_query("UPDATE ad_clk SET impression='$newimp' WHERE id='$adi'") or die(mysql_error()); $d = mysql_query("SELECT * FROM users WHERE user_id='$uid'") or die(mysql_error()); while ($re = mysql_fetch_array($d)){ $money1 = $re['money']; } $newmoney = $money + $money1; $e = mysql_query("UPDATE users SET money='$newmoney' WHERE user_id='$uid'") or die(mysql_error()); $f = mysql_query("INSERT INTO ad_clk_hits (id,user_id,date,adv_id) VALUES ('','$uid','$date','$adi')") or die(mysql_error()); ?> <!-- Show magical div --> <script type="text/javascript"> function showIt() { document.getElementById("view_ad_text_right").style.display = "block"; } // 1000 = 1 sec | 60000 is 1 minute </script> <!-- END Show magical div --> <body onLoad='setTimeout("showIt()", 16000);'></body> <!-- Magic DIV --> <div id="view_ad"> <script type="text/javascript"> $(document).ready(function () { setTimeout(function () { $('#view_text').hide(); }, 6000); }); </script> <div id="view_text">Please wait for 15 secs</div> <div id='view_ad_text_right' style="display:none;">Thank you for visiting...</div> </div> <!-- END Magic DIV --> <iframe src="<?php echo $link; ?>" width="100%" height="100%" /></iframe> <?php } ?> Any help will bew grately appreciated.... Quote Link to comment Share on other sites More sharing options...
Solution kicken Posted May 5, 2013 Solution Share Posted May 5, 2013 Make sure your variables that are used in the SQL queries have been escaped using mysql_real_escape_string, or even better, update your code to use PDO and prepared statements. Secondly, rather than do some SELECT's to get $money and $money1 you can do the whole thing in a single UPDATE query which would prevent race-conditions resulting in a bad money value. My syntax may be off some as I typically used SQL Server that has a different syntax. Check the mysql manual for syntax details UPDATE users u INNER JOIN ad_clk a ON id=$adi SET u.money=u.money+a.money WHERE u.id=$uid Quote Link to comment Share on other sites More sharing options...
subhomoy Posted May 6, 2013 Author Share Posted May 6, 2013 can u plz refer me the sites from where i can learn all those sql queries in that typical manner.... Thank you... Quote Link to comment Share on other sites More sharing options...
Irate Posted May 6, 2013 Share Posted May 6, 2013 A quick Google research gave me this: http://dev.mysql.com/doc/refman/5.1/en/sql-syntax.html Alternatively, check if you have any IT stores near your location who sell books on that matter, it works wonders. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.