php - Escaping for username and URL text boxes -
my site got hacked few times , i'm using post comment on flat file. have tried escape string in past and, since i'm not using sql, can't use mysql_real_escape_string. however, have tried many other ways keep string free stuff this: <#$()[]{},.;!. use code can see below:
$newdata = nl2br(htmlspecialchars($_post['ta'], ent_quotes, 'utf-8')); i use this:
$search = array("!", "$", "%", "(", ")"); $urls = str_replace($search, " ", $url); finally, use this:
if (keychar == "`" || keychar =="#" || keychar =="^" || keychar =="*") { none of them seem work , site still got hacked. wondering if has ideas or can point me in right direction.
i believe textarea fine. i'm not 100% sure know url textbox pix , username vulnerable. i'm trying learn how close vulnerability , can see isn't working.
<style> div.container { width: 100%; border: 1px solid gray; } header, footer { padding: 1em; color: white; background-color: black; clear: left; text-align: center; } nav { float: left; max-width: 160px; margin: 0; padding: 1em; } nav ul { list-style-type: none; padding: 0; } nav ul { text-decoration: none; } article { margin-left: 170px; border-left: 1px solid gray; padding: 1em; overflow: hidden; } fieldset { word-break: break-all; border:1px solid #999; border-radius:8px; box-shadow:0 0 10px #999; width:97%; } legend { background:#fff; } table { word-break: break-all; width:97%; border:0; cellspacing:0; cellpadding:0; } div { overflow:hidden; border: solid 2px gray; padding: 1em; } </style> <!doctype html> <html> <body> <?php // $date = "".date("f d y h:i:s."); $date = "".date("g:ia \n l js f y") . "\n"; $myfile = "file.txt"; if(isset($_post['ta'])){ if(isset($_post['urls'])){ $url = $_post['urls']; } $wordcount = str_word_count($_post['ta']); $myfile ="file.txt"; $newdata = nl2br(htmlspecialchars($_post['ta'], ent_quotes, 'utf-8')); $nn = nl2br(htmlspecialchars($_post['namee'], ent_quotes, 'utf-8')); // $fieldsetstring = // $fieldsetfilter = htmlspecialchars($fieldsetstring, ent_quotes, 'utf-8'); $handle = fopen($myfile, 'a+'); // fwrite($handle, '<fieldset><legend>anonymous: ' . $date . '</legend>' . $newdata . '</fieldset></br>'); fwrite($handle, '<div><fieldset><legend><img src="'.$urls.'" width="42" height="42">' . $nn . ' : ' . $date . '</a></legend><table><tr><td><h1>' . $newdata . '</h1></td></tr></table></fieldset></div></br>'); fclose($handle); } ?> <br/> <br/> <br/> <?php if(file_exists("$myfile")){ $mydata = file_get_contents("$myfile"); } ?> <a></a> <form action = "index.php" method = "post" style="align:center"> username : <input type="text" name="namee" value="anonymous" style="text-align:center" onkeypress="return check(event)"/> url : <input type="text" name="urls" value="http://findicons.com/files/icons/398/halloween/128/jack.png" style="text-align:center; width:30%" onkeypress="return check(event)" onkeyup="return check(event)"/></br> <textarea name="ta" cols="64" rows="10"></textarea> <br /><br /> <input name="mybtn" type="submit" value="submit"/> </body> </html>i have tried many escapes stack overflow before post this. in fact, have been trying figure out month , i'm sure got hacked more few times. , that's know. awesome.
you can try function:
function protect($data) { $data = trim($data); $data = stripslashes($data); $data = htmlspecialchars($data); return $data; } update: code explanation
the function takes variable or argument , passes through php's trim, stripslashes , htmlspecialchars functions. returned variable safe possible injections.
Comments
Post a Comment