saxchick1
11-22-2011, 03:38 AM
I've been reading different tutorials on injections and been going by different examples. I am trying to prevent my guestbook users from spamming my guestbook and preventing xss, html, and sql injections. I've read that prepared statements automatically prevent injections, and that mysql_real_escape_string() along with string sanization to prevents sql injection. Also, I read that prepared statements shouldnt be used. If someone could please help and look over my code, not sure if I am getting the hang of things. :confused:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!--
Author: Reality Software
Website: http://www.realitysoftware.ca
Note: This is a free template released under the Creative Commons Attribution 3.0 license,
which means you can use it in any way you want provided you keep the link to the author
intact.
-->
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>
<link href="style.css" rel="stylesheet" type="text/css" /></head>
<body>
<!-- header -->
<div id="header">
<div id="logo"><a href="index.html">Header</a></div>
<div id="menu">
<ul>
<li><a href="index.html">Home</a></li>
<li><a href="">Link 1</a></li>
<li><a href="">Link 2</a></li>
<li><a href="">Link 3</a></li>
<li><a href="">Contact</a></li>
<li><a href="guestbook.php">Guestbook</a></li>
</ul>
</div>
</div>
<div id="icon"><a href="twitter.com/">
<img border="0" src="http://www.***************/forum/images/twitter.png" alt="twitter"
width="58px;" height="53px;" />
</a></div>
<!--end header -->
<!-- main -->
<div id="main">
<div id="content">
<div id="text">
<h1><strong>Guestbook</strong></h1>
</div>
<?php
function sanitizeString($string) {
return htmlentities( (string) $string, ENT_COMPAT, "UTF-8" );
}
$input = is_numeric($input) ? intval($input) : mysql_real_escape_string($input);
mysql_real_escape_string($comment);
mysql_real_escape_string($name);
mysql_real_escape_string($verif_box);
$db = new mysqli("localhost", "a7560006_host", "mypassword", "a7560006_guest");
$preparedStatement1 = $db->prepare('SELECT * FROM guestbook WHERE name = ? and verif_box = ? and comment = ? ');
$preparedStatement1 ->bind_param("s", $name);
$preparedStatement1 ->execute();
$prerapedStatement1->bind_result($comment_id,$name,$comment,$datetime);
$preparedStatement1->store();
$preparedStatement2 = $db->prepare('SELECT * FROM guestbook WHERE name = ? and verif_box = ?
and comment = ? ');
$preparedStatement2 ->bind_param("s", $verif_box);
$preparedStatement2 ->execute();
$prerapedStatement1->bind_result($comment_id,$name,$comment,$datetime);
$preparedStatement2->store();
$preparedStatement3 = $db->prepare('SELECT * FROM guestbook WHERE name = ? and verif_box = ?
and comment = ? ');
$preparedStatement3 ->bind_param("s", $comment);
$preparedStatement3 ->execute();
$prerapedStatement1->bind_result($comment_id,$name,$comment,$datetime);
$preparedStatement2->store();
while($preparedStatement1->fetch()){
$mysql_host = "localhost";
$mysql_database = "a7560006_guest";
$mysql_user = "a7560006_host";
$mysql_password = "mypassword";
// Connect to server and select database.
mysql_connect("$mysql_host", "$mysql_user", "$mysql_password") or die("cannot connect
server");
mysql_select_db("$mysql_database") or die("cannot select DB");
$tbl_name="guestbook"; // Table name
$name = ($_POST['name']);
$comment = ($_POST['comment']);
$datetime=date("M-d-Y h:i:s A"); //date time
$verif_box = ($_POST['verif_box']);
if(md5($verif_box).'a4xn' != $_COOKIE['tntcon']){ ?>
<table width="400" border="0" align="center">
<tr><td align="center"><h4>You have not entered captcha or entered incorrect
captcha!</h4></td></tr>
</table>
</div>
<!-- footer -->
<div id="footer">
<div id="left_footer">© Copyright 2011<strong> Author </strong></div>
<div id="right_footer">
<!-- Please do not change or delete this link. Read the license! Thanks. :-) -->
Design by <a href="http://www.realitysoftware.ca" title="Website Design">Reality
Software</a>
</div>
</div>
<!-- end footer -->
</div>
<!-- end main -->
</body>
</html>
<?
exit;
}
if(empty($name) || empty($comment)) { ?>
<table width="400" border="0" align="center">
<tr><td align="center"><h3>Sorry, all fields are required!</h3></td></tr>
</table>
<?
} else {
$sql="INSERT INTO $tbl_name (name, comment, datetime) VALUES ('$name', '$comment',
'$datetime')";
$result=mysql_query($sql);
//check if query successful
if($result) { ?>
<table width="400" border="0" align="center">
<tr><td align="center"><h3>Thank you for signing my guestbook!</h3></td></tr>
</table>
<?
echo "<meta http-equiv='Refresh' content='1; URL=viewguestbook.php'>"; // link to view
guestbook page
} else {
echo "ERROR";
}
mysql_close();
}
}
?>
</div>
<!-- footer -->
<div id="footer">
<div id="left_footer">© Copyright 2011<strong> Author </strong></div>
<div id="right_footer">
<!-- Please do not change or delete this link. Read the license! Thanks. :-) -->
Design by <a href="http://www.realitysoftware.ca" title="Website Design">Reality
Software</a>
</div>
</div>
<!-- end footer -->
</div>
<!-- end main -->
</body>
</html>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!--
Author: Reality Software
Website: http://www.realitysoftware.ca
Note: This is a free template released under the Creative Commons Attribution 3.0 license,
which means you can use it in any way you want provided you keep the link to the author
intact.
-->
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>
<link href="style.css" rel="stylesheet" type="text/css" /></head>
<body>
<!-- header -->
<div id="header">
<div id="logo"><a href="index.html">Header</a></div>
<div id="menu">
<ul>
<li><a href="index.html">Home</a></li>
<li><a href="">Link 1</a></li>
<li><a href="">Link 2</a></li>
<li><a href="">Link 3</a></li>
<li><a href="">Contact</a></li>
<li><a href="guestbook.php">Guestbook</a></li>
</ul>
</div>
</div>
<div id="icon"><a href="twitter.com/">
<img border="0" src="http://www.***************/forum/images/twitter.png" alt="twitter"
width="58px;" height="53px;" />
</a></div>
<!--end header -->
<!-- main -->
<div id="main">
<div id="content">
<div id="text">
<h1><strong>Guestbook</strong></h1>
</div>
<?php
function sanitizeString($string) {
return htmlentities( (string) $string, ENT_COMPAT, "UTF-8" );
}
$input = is_numeric($input) ? intval($input) : mysql_real_escape_string($input);
mysql_real_escape_string($comment);
mysql_real_escape_string($name);
mysql_real_escape_string($verif_box);
$db = new mysqli("localhost", "a7560006_host", "mypassword", "a7560006_guest");
$preparedStatement1 = $db->prepare('SELECT * FROM guestbook WHERE name = ? and verif_box = ? and comment = ? ');
$preparedStatement1 ->bind_param("s", $name);
$preparedStatement1 ->execute();
$prerapedStatement1->bind_result($comment_id,$name,$comment,$datetime);
$preparedStatement1->store();
$preparedStatement2 = $db->prepare('SELECT * FROM guestbook WHERE name = ? and verif_box = ?
and comment = ? ');
$preparedStatement2 ->bind_param("s", $verif_box);
$preparedStatement2 ->execute();
$prerapedStatement1->bind_result($comment_id,$name,$comment,$datetime);
$preparedStatement2->store();
$preparedStatement3 = $db->prepare('SELECT * FROM guestbook WHERE name = ? and verif_box = ?
and comment = ? ');
$preparedStatement3 ->bind_param("s", $comment);
$preparedStatement3 ->execute();
$prerapedStatement1->bind_result($comment_id,$name,$comment,$datetime);
$preparedStatement2->store();
while($preparedStatement1->fetch()){
$mysql_host = "localhost";
$mysql_database = "a7560006_guest";
$mysql_user = "a7560006_host";
$mysql_password = "mypassword";
// Connect to server and select database.
mysql_connect("$mysql_host", "$mysql_user", "$mysql_password") or die("cannot connect
server");
mysql_select_db("$mysql_database") or die("cannot select DB");
$tbl_name="guestbook"; // Table name
$name = ($_POST['name']);
$comment = ($_POST['comment']);
$datetime=date("M-d-Y h:i:s A"); //date time
$verif_box = ($_POST['verif_box']);
if(md5($verif_box).'a4xn' != $_COOKIE['tntcon']){ ?>
<table width="400" border="0" align="center">
<tr><td align="center"><h4>You have not entered captcha or entered incorrect
captcha!</h4></td></tr>
</table>
</div>
<!-- footer -->
<div id="footer">
<div id="left_footer">© Copyright 2011<strong> Author </strong></div>
<div id="right_footer">
<!-- Please do not change or delete this link. Read the license! Thanks. :-) -->
Design by <a href="http://www.realitysoftware.ca" title="Website Design">Reality
Software</a>
</div>
</div>
<!-- end footer -->
</div>
<!-- end main -->
</body>
</html>
<?
exit;
}
if(empty($name) || empty($comment)) { ?>
<table width="400" border="0" align="center">
<tr><td align="center"><h3>Sorry, all fields are required!</h3></td></tr>
</table>
<?
} else {
$sql="INSERT INTO $tbl_name (name, comment, datetime) VALUES ('$name', '$comment',
'$datetime')";
$result=mysql_query($sql);
//check if query successful
if($result) { ?>
<table width="400" border="0" align="center">
<tr><td align="center"><h3>Thank you for signing my guestbook!</h3></td></tr>
</table>
<?
echo "<meta http-equiv='Refresh' content='1; URL=viewguestbook.php'>"; // link to view
guestbook page
} else {
echo "ERROR";
}
mysql_close();
}
}
?>
</div>
<!-- footer -->
<div id="footer">
<div id="left_footer">© Copyright 2011<strong> Author </strong></div>
<div id="right_footer">
<!-- Please do not change or delete this link. Read the license! Thanks. :-) -->
Design by <a href="http://www.realitysoftware.ca" title="Website Design">Reality
Software</a>
</div>
</div>
<!-- end footer -->
</div>
<!-- end main -->
</body>
</html>