holly9 Posted April 3, 2014 Share Posted April 3, 2014 (edited) hi, i want to display members banners on my site that i'm making from scracth.The banners urls will be retrieve from the mysql database.the site url will not be display on the site but when a visitor clicks the banner the site url will be taken from database and redirect the visitor to the member site.i don't want people to upload banners to folders because of satey reasons so instead they have to give me their banner urls.i want to have many members so i won't be able to check every banner and i don't want reciprocal banners because they can hurt the site if it has malware.i have another question can malware appear on site with just the banner url? or do people need to visit a member site to get malware or viruses?.thanks. echo "<a href=\" " . htmlentities(stripslashes(constant('MY_SITE_URL'))) . "/". "?Clicked=" . urlencode($row['MEMBERID']) . "\" target=\"_blank\"> <img src=\"".$row['MemberBannerUrl'] . "\" alt=\"banner\" border=\"0\" height=\"60\" width=\"468\"></a>"; Edited April 3, 2014 by holly9 Quote Link to comment https://forums.phpfreaks.com/topic/287504-is-this-a-reciprocal-banner/ Share on other sites More sharing options...
Rifts Posted April 4, 2014 Share Posted April 4, 2014 wtf is your question Quote Link to comment https://forums.phpfreaks.com/topic/287504-is-this-a-reciprocal-banner/#findComment-1474917 Share on other sites More sharing options...
holly9 Posted April 4, 2014 Author Share Posted April 4, 2014 (edited) wtf is your question You didnt had to say it like that. Well you won't be able to help because you don't know the definition of a reciprocal link. People use reciprocal links/back links to gain site popularity. To others: This is a reciprocal banner.Members site url and banner url will be link to my site: echo "<a href=\"".$row['Member_SITE_Url'] . "\" target=\"_blank\"> <img src=\"".$row['Member_Banner_Url'] . "\" alt=\"banner\" border=\"0\" height=\"60\" width=\"468\"></a>"; I'm wondering if code below is still a reciprocal banner? because the member site url is not used here so when a visitor clicks on banner i'll use $_GET["Clicked"]; to retrieve the member's ID to get their site url from the mysql database and i'll use header('Location:' . htmlentities(stripslashes($row['Member_site_url']))); exit; to send visitor to member's site. echo "<a href=\" " . htmlentities(stripslashes(constant('MY_SITE_URL'))) . "/". "?Clicked=" . urlencode($row['MEMBER_ID']) . "\" target=\"_blank\"> <img src=\"".$row['Member_Banner_Url'] . "\" alt=\"banner\" border=\"0\" height=\"60\" width=\"468\"></a>"; Edited April 4, 2014 by holly9 Quote Link to comment https://forums.phpfreaks.com/topic/287504-is-this-a-reciprocal-banner/#findComment-1474929 Share on other sites More sharing options...
holly9 Posted April 4, 2014 Author Share Posted April 4, 2014 Hey, Nevermind all i'll try to figure it out myself. My question seems confusing for some lol. I tried my best to explain the best as I can but that didn't work out.... Quote Link to comment https://forums.phpfreaks.com/topic/287504-is-this-a-reciprocal-banner/#findComment-1474992 Share on other sites More sharing options...
Solution davidannis Posted April 4, 2014 Solution Share Posted April 4, 2014 Some questions take time to get answered. The answer is yes, someone can make your site load malware if they can control the URL in your IMG tag. Embedded HTML TagsSeveral HTML tags possess attributes that initiate Web browser HTTP requests automatically upon page load. Anexample is the IMG (image) tag and SRC attribute. The SRC attribute is used to specify the URL location of image filesfor display in Web pages. When your browser loads Web pages with IMG tags, the images are automatically requestedand appear within the browser. But, the SRC attribute can also be used to reference URLs, from any Web server, notonly those containing images.For instance, if we performed a Google search for “WhiteHat Security” we’d end up with the following URL:http://www.google.com/search?hl=en&q=whitehat+security&btnG=Google+SearchThis URL could be easily substituted inside the IMG SRC attribute, thereby forcing your Web browser to perform thatexact same Google search.<img src=”http://www.google.com/search?hl=en&q=whitehat+security&btnG=Google+Search”>Obviously forcing a Web browser to send a Google search request is more or less harmless. However, the sameprocess of URL construction can be used to automatically make a Web browser transfer bank account funds, postinflammatory comments, or even hack a website. The point is that this one mechanism of forcing a Web browser toconnect to another website enables XSS worm propagation source: https://www.whitehatsec.com/assets/WP5CSS0607.pdf Quote Link to comment https://forums.phpfreaks.com/topic/287504-is-this-a-reciprocal-banner/#findComment-1474996 Share on other sites More sharing options...
holly9 Posted April 4, 2014 Author Share Posted April 4, 2014 Some questions take time to get answered. The answer is yes, someone can make your site load malware if they can control the URL in your IMG tag. source: https://www.whitehatsec.com/assets/WP5CSS0607.pdf Thanks for the help! . Quote Link to comment https://forums.phpfreaks.com/topic/287504-is-this-a-reciprocal-banner/#findComment-1474999 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.