phpSensei Posted August 29, 2007 Share Posted August 29, 2007 My forum isnt really finished but I would like to get some opinion of how it is so far. I would appreciate if you see some security holes? http://obb.awardspace.com/index.php NOTE: If the connection does not work, just click backspace until you see the index page, then refresh. THE SITE HOSTING SERVICE SUCKS! Link to comment Share on other sites More sharing options...
phpSensei Posted August 29, 2007 Author Share Posted August 29, 2007 There Are no Registrations, or logins. No directories are blocked, but im sure you can't find them anyways.. Link to comment Share on other sites More sharing options...
lightningstrike Posted August 29, 2007 Share Posted August 29, 2007 It's quite well designed. However it has very limited functionality. Also when posting a message with the text ' OR it became \' OR (escaped) which should not be shown the user. Rather then escaping the message use htmlentities($text,ENT_QUOTES); which will encode quotes rather then escape them. I also don't believe that you have made a flood defense feature, although the web host is too slow to test that out. Also at the bottom of every post near the icons i see text "dd232323" perhaps remove that After posting a new topic it says refreshing and takes you to a page on local host which we clearly can't access. That's about as much I've checked out so far. Link to comment Share on other sites More sharing options...
phpSensei Posted August 29, 2007 Author Share Posted August 29, 2007 oh forgot that, I was going to fix that htmlentities thing awhile go, but forgot. I also havent made a flood system at all, I will create a cookie for the last topic made by the user, then if 30 seconds havnt passed, he cant post a new topic....etc ONE MORE THING! which random text after every post do you speak of? I can't seem them! Maybe you can print screen it or something.... THANKYOU btw. Link to comment Share on other sites More sharing options...
lightningstrike Posted August 29, 2007 Share Posted August 29, 2007 I would personally recommend a database IP specific timed ban for flood limits but that's up to you. I believe the random text I am seeing is actually a bunch of images ALT tags. images/spacer.gif is not loading for me so I see it's text tag instead. Link to comment Share on other sites More sharing options...
phpSensei Posted August 29, 2007 Author Share Posted August 29, 2007 lol, slow hosting service, but I am not getting that problem. Everything works great... Try refreshing. Link to comment Share on other sites More sharing options...
phpSensei Posted August 29, 2007 Author Share Posted August 29, 2007 UPDATE: htmlentities on every topic and replies... Link to comment Share on other sites More sharing options...
tommyboy123x Posted August 29, 2007 Share Posted August 29, 2007 some more stylistic / usage comments: - Top Posters: none - Most Popular Member: none doesnt really seem necessary on the home page. I could see where it would be a good idea and i like the originality, but i feel this would be better suited on the members page. http://obb.awardspace.com/index.php?page=viewtopic&forum=2&topic=5 notice the DD2323WHATEVER next to the buttons... nuff said no bw filter, you have a literal "<" displayed in place of the <, same for greater than, quote, amp, and your forgetting to strip the slashes. It seems your storing the information safely but not displaying it nicely. Also to post a topic it was painful... and you used GET variables meaning it would easily be able to make random spam topics with a bot or something. overall I'd be very proud of that if i were you. Its a great accomplishment, if you will, to create a forum. Link to comment Share on other sites More sharing options...
phpSensei Posted August 29, 2007 Author Share Posted August 29, 2007 thankyou means, alot to me... I just made a swearing filter, but havnt uploaded it. Also, I fixed the strip slashes too... Link to comment Share on other sites More sharing options...
php_tom Posted August 29, 2007 Share Posted August 29, 2007 Whoa... I just replied to a post and got this: Warning: mysql_real_escape_string(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 70 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 70 Warning: mysql_real_escape_string(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 71 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 71 Warning: mysql_real_escape_string(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 106 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 106 Warning: mysql_real_escape_string(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 107 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 107 Warning: mysql_query(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 111 Warning: mysql_query(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 111 Warning: mysql_query(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 113 Warning: mysql_query(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 113 Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /home/www/obb.awardspace.com/index.php on line 113 Warning: mysql_query(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 117 Warning: mysql_query(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 117 Warning: mysql_query(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 118 Warning: mysql_query(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 118 Warning: mysql_query(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 120 Warning: mysql_query(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 120 Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /home/www/obb.awardspace.com/index.php on line 121 Warning: mysql_query(): Access denied for user 'ndowlat'@'82.197.131.25' (using password: NO) in /home/www/obb.awardspace.com/index.php on line 123 Warning: mysql_query(): A link to the server could not be established in /home/www/obb.awardspace.com/index.php on line 123 You might want to fix it! Link to comment Share on other sites More sharing options...
phpSensei Posted August 29, 2007 Author Share Posted August 29, 2007 sorry, i was changing some stuff around... Try again in 5 minutes. Link to comment Share on other sites More sharing options...
phpSensei Posted August 29, 2007 Author Share Posted August 29, 2007 k, I fixed alot of bugs... Link to comment Share on other sites More sharing options...
AbydosGater Posted August 30, 2007 Share Posted August 30, 2007 Dont know if this is a coding error or something that someone did but... http://obb.awardspace.com/index.php?page=viewtopic&forum=2&topic=4 Mysql_fetch_array errors. Andy Btw: Nice work i really like it. Alot more work to be done but keep it up! Link to comment Share on other sites More sharing options...
source Posted August 30, 2007 Share Posted August 30, 2007 same old same old: http://obb.awardspace.com/index.php?page=viewforum&forum=%22%3E%3Cmarquee%3Elolz http://obb.awardspace.com/index.php?page=viewforum&forum=2&row=-1 http://obb.awardspace.com/index.php?page=newreply&forum=2&topic=%22%3E%3Cmarquee%3Elolz http://obb.awardspace.com/index.php?page=viewforum&forum=2&sort=' Link to comment Share on other sites More sharing options...
phpSensei Posted August 30, 2007 Author Share Posted August 30, 2007 same old same old: http://obb.awardspace.com/index.php?page=viewforum&forum=%22%3E%3Cmarquee%3Elolz http://obb.awardspace.com/index.php?page=viewforum&forum=2&row=-1 http://obb.awardspace.com/index.php?page=newreply&forum=2&topic=%22%3E%3Cmarquee%3Elolz http://obb.awardspace.com/index.php?page=viewforum&forum=2&sort=' oh don't worry, I have a list of things not done yet, but you name some of them... alot of the things are vulnerable... Link to comment Share on other sites More sharing options...
phpSensei Posted August 30, 2007 Author Share Posted August 30, 2007 same old same old: http://obb.awardspace.com/index.php?page=viewforum&forum=%22%3E%3Cmarquee%3Elolz http://obb.awardspace.com/index.php?page=viewforum&forum=2&row=-1 http://obb.awardspace.com/index.php?page=newreply&forum=2&topic=%22%3E%3Cmarquee%3Elolz http://obb.awardspace.com/index.php?page=viewforum&forum=2&sort=' k, I forgot to validate the forum variable to is_numeric... Link to comment Share on other sites More sharing options...
phpSensei Posted August 30, 2007 Author Share Posted August 30, 2007 NEW UPDATE: Users can now choose the BOLD bbcode or Italic Link to comment Share on other sites More sharing options...
agentsteal Posted August 30, 2007 Share Posted August 30, 2007 SQL Error: http://obb.awardspace.com/index.php?page=viewforum&row=' Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-12, 12' at line 1 Link to comment Share on other sites More sharing options...
phpSensei Posted August 30, 2007 Author Share Posted August 30, 2007 I fixed that a long time ago... try it again Agentsteal. Link to comment Share on other sites More sharing options...
phpSensei Posted August 31, 2007 Author Share Posted August 31, 2007 UPDATE: User's are able to use the following bbcodes: BOLD , Italic, and Underline Link to comment Share on other sites More sharing options...
deadimp Posted September 11, 2007 Share Posted September 11, 2007 I tried viewing it, but it said that there were too many connections. Try a different host out. I'd suggest x10hosting or Freeweb7. Link to comment Share on other sites More sharing options...
Recommended Posts