Anyway, you should first find out if this would be permitted or accepted. And somehow, i don't think it is.
Quote:
|
While on cardomain.com, viewing a car profile, can php locate the "view/sign my guestbook" link on the page, enter into the link, then in the page that shows up with the guestbook entries either clicks the "Add a new comment" link at the top of the page (it forces you to the guestbook form at the very bottom of the page) or just jumps to the form at the bottom of the page. Once you're in the guestbook form, it automatically pastes a small msg and saves it.
|
Well, all that isn't necessary, because the final form to enter the message looks like
Code:
<form action="view_guestbook.pl" method="get"><input type="hidden" name="page_id" value="458832">
<a name="add_comment">
<br><font face="Verdana,Arial,Helvetica" size="2"><b>Add a new comment:</b>
<br><textarea name="text" cols="60" rows="5"></textarea>
<input type="hidden" name="action" value="post">
<br> <input type="image" src="http://images.cardomain.com/sites/cardomain/member_pages/post_comment.gif" alt="post" border="0" width="72" height="21"></form>
The relevant parts are in bold. They post the data using the get-method, which means that you can get the same result as posting a form, by composing the querystring yourself.
So hitting this link, or redirecting to it, will add the message "test" to one of the ferrari testarossa guestbooks.
http://www.cardomain.com/member_page...st&action=post
But you first need to be logged in before you can request the page with that url. (i didn't bother registering to try it out) The only thing you need then, is a script to get the page_id numbers of everyone with such a car. Not very complicated --> request some overview page of that car and then run a script to select all page_id variable values. you'll need a small regex for that.
Then you just need to store them in an array and loop through it, dynamically replacing the page_id value by the element of the array.
If they are smart enough to run such a large site, then they'll probably previewed such message floading and set a timer to force a limit between 2 messages from the same member ... There are ways arround that to, but if they have such checks in place, then you are definitely trying to run an unwanted and unacceptable action.
And if it's not accepted behaviour, then they'll probably just close your account or tighten there posting-logic.
But with the current setup, it surely looks as if it is set up to allow posting into a guesbook from an external site or inside a loop.
Before you post, read our: 
