PHP Basic Tutorials ,PHP Sources Code,PHP Online Example

Algorithms Arrays Passwords Uncategorized
Commerce Uncategorized
Databases Abstraction Layers Informix LDAP MS SQL MySQL ODBC PostgreSQL Uncategorized
Date & Time Calculators Conversion Translation Uncategorized
Discussion Chat Forums Guestbooks Polls Uncategorized
Email Validation Uncategorized
External Uncategorized
Files and Directories Uncategorized
Games Uncategorized
Graphics 3-D Graphs Resizing Thumbnails Uncategorized
HTML Forms Menus & Navigation Source Viewers Tables Templates Uncategorized
HTTP Authentication Cookies File Uploading Uncategorized
I18N Uncategorized
Math Uncategorized
Miscellaneous Uncategorized
Searching and Trees Uncategorized
Security Uncategorized
Text Uncategorized
Utilities Calendars Counters Link Checkers Weather Uncategorized
XML Uncategorized

php sample source codes
The class can be used for manipulating unix password files, created with htpasswd. It is possible to add, remove and update users. <? // pwfile.req class PwFile { var $fp; // filepointer var $filename; function PwFile($filename) // constructor { $this->fp = fopen ($filename,"r+"); $this->filename = $filename; } function existsUser ($usr_ID) { rewind($this->fp); //rewind filepointer while (feof($this->fp) == 0) { $line = chop(fgets($this->fp,1000)); //read line from file $arr = split(":", $line); //slit at ':' if ($arr[0] == $usr_ID) { return 1; // username found } else { return 0; // username not found } } } function getFileSize() { return (filesize($this->filename)); } function write_temp ($contents) { echo "<pre>$contents</pre>"; $temp_filename = tempnam ("/tmp", "php_"); echo "<br>$temp_filename<br>"; $temp_fp = fopen($temp_filename, w); fwrite($temp_fp, $contents); fclose($temp_fp); fclose($this->fp); copy ($temp_filename, $this->filename); $this->fp = fopen($this->filename, "r+"); //unlink($temp_filename); } function addUser ($usr_ID, $usr_passwd) { rewind($this->fp); $contents = fread($this->fp, $this->getFileSize()); echo "<pre>bevor $contents</pre>"; $contents .= "$usr_ID:".crypt($usr_passwd)."\n"; echo "<pre>danach $contents</pre>"; $this->write_temp($contents); } function deleteUser ($usr_ID) { $contents = ""; rewind($this->fp); while (feof($this->fp) == 0) { $line = ""; $line = chop(fgets($this->fp,1000)); $arr = split(":", $line); if ($arr[0] != $usr_ID) { echo $arr[0] ." ist nicht gleich ". $usr_ID; $contents .= $line . "\n"; } } echo "<hr>$contents<hr>"; $contents = chop ($contents); $contents .= "\n"; // kind a tricky $this->write_temp($contents); } function updateUser ($usr_ID, $usr_passwd) { $this->deleteUser($usr_ID); $this->addUser($usr_ID,$usr_passwd); } } ?>
Creates cookies to keep track of a logged in user. A lot of md5 + server-side secret keeps normal "crackers" from forging tickets. Good for times when you don't have SSL. UPDATE: For added security, place secret.php outside of your web tree so that if PHP breaks they can't easily reach the hash value. Also, forgot to add the PASSWORD into the hash! Silly me! TODO: Make the cookies update as the user continually checks in so that the cookies expire after X seconds of INACTIVITY vs. a flat 36000 seconds. <?PHP // secret.php: $secret = md5( "sdfkjsdkflhkh23hkjsdk#$@%$#%DSF" ); ?> <?PHP // validate.php /////////////////////// // Function Name : validate // Function Purpose: Validates the user's ticket and makes sure they are logged in // Recieves : $username - the username of the current user; // $session_key - the session key of the user; // $expriation_time - how long till the ticket expires?; // $hash - hash of all three of those + server secret; // $passhash - password of the current user // Returns : 1 if validated, 0 otherwise /////////////////////// function validate( $username, $session_key, $expiration_time, $hash, $passhash ) { include "secret.php"; $h = md5( $username . $session_key . $expiration_time . $secret . $passhash ); if( $hash == $h && time( ) < $expiration_time ) { return 1; } else { return 0; } // end if } // end function validate // end validate.php ?> <?PHP // login.php // do some login type stuff // username and password verified via some method; // $username holds the contents of their username // $password holds the contents of their password require( "secret.php" ); $session_key = microtime( ) . $username; $expiration_time = time( ) + 36000; $passhash = md5( $password . $secret ); $hash = md5( $username . $session_key . $expiration_time . $secret . $passhash ); setcookie( "username", $username, time( ) + 36000, "/", "", 0 ); setcookie( "session_key", $session_key, time( ) + 36000, "/", "", 0 ); setcookie( "expiration_time", $expiration_time, time( ) + 36000, "/", "", 0 ); setcookie( "hash", $hash, time( ) + 36000, "/", "", 0 ); setcookie( "passhash", $passhash, time( ) + 36000, "/", "", 0 ); // end login.php ?>
This is a function which will format the passed string depending of it's specified to be a number or a string, in order to avoid problems with SQL injections in scripts. function ToDBString($string, $link, $isNumber=false) { //If $isNumber==true we are specting a number if($isNumber) { //A correct number must be composed of: // - Zero or more integers followed by a decimal point and one or more integers (i.e.: .9 (0.9) or 9.9) // - One or more integers followed by a decimal point. (i.e.: 9. (9.0)) // - One or more integers (i.e.: 999) if(preg_match("/^\d[\.,']\d+\|\d+[\.,']\|\d+$/A", $string)) //If it's a correct number we change the colon, quote or point ("'", "," or ".") by a decimal piont. return preg_replace( array( "/^(\d+)[\.,']$/" , //9. "/^(\d)[\.,'](\d+)$/" //.9 or 9.9 ), array( "\\1." , "\\1.\\2" ) , $string); else //If it's not a correct number we show ERROR die("ERROR: Not a number\"".$string."\""); } else //If $string is a string ($isNumber==false) we return "'$string'" correctly escaped (in this version I also strip HTML tags and modify some things in the string, change it if you wish). return "'".mysql_real_escape_string(htmlentities(strtoupper(trim(strip_tags($string)))), $link)."'"; }
Avoid URL injection. Easy to improve the security (phising, etc..) of your site if you are calling one .php to centralize all your DB connections. <? // ==================================================================== // // Avoid URL injection code. Easy to improve the security (phising, etc..) // of all your site when if are calling one .php to centralize all your // DB connections. // // mailto: Vicente<sysvic@gmail.com> // // ==================================================================== $req = $_SERVER['REQUEST_URI']; $cadena = explode("?", $req); $mi_url = $cadena[0]; $resto = $cadena[1]; // here you can put your suspicions chains at your will. Just be careful of // possible coincidences with your URL's variables and parameters $inyecc='/script\|http\|<\|>\|%3c\|%3e\|SELECT\|UNION\|UPDATE\|AND\|exe\|exec\|INSERT\|tmp/i'; // detecting if (preg_match($inyecc, $resto)) { // make something, in example send an e-mail alert to administrator $ip = $HTTP_SERVER_VARS["HTTP_CLIENT_IP"]; $forwarded = $HTTP_SERVER_VARS["HTTP_X_FORWARDED_FOR"]; $remoteaddress = $HTTP_SERVER_VARS["REMOTE_ADDR"]; $message = "attack injection in $mi_url \n\nchain: $resto \n\n from: (ip-forw-RA):- $ip - $forwarded - $remoteaddress\n\n --------- end --------------------"; mail("youremail@email.com", "Attack injection", $message, "From: host@{$_SERVER['SERVER_NAME']}", "-fwebmaster@{$_SERVER['SERVER_NAME']}"); // message and kill execution echo 'illegal url'; die(); } // From here you can start safely your DB connection $connection=mysql_connect(); //..etc. ?>
This is a piece of code to help reduce security holes at the application level. <? #################################################################### # PHP CGI-Filter, can be used with $_COOKIE, $_POST, $_GET, etc... # Date : 11/05/2003 # Version : 0.9 # Author : Cameron Jacobson # Questions / Comments : cameron@tripdubdev.com # Please send word of any benchmarks produced, best order for the 'alphabet' string, etc... # Installation: Include the following line at the top of your script # include 'filename.php'; where filename is the name of this file # Instructions: # Define the characters you will allow in your PHP apps in the # $alphabet variable... # AND, add variables accordingly if you want to filter # $_COOKIE, $_FILES, $_SESSION variables, etc... # NOTE: In order for this filter to be useful, you should not have # REGISTER_GLOBALS on, or should at least not program # your scripts as though it were on # LICENSE : To use this piece of software you must agree with # the terms and conditions of the GNU GPL. #################################################################### $alphabet="\r\n abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890<>=/._"; $post=$_POST; $get=$_GET; $postcount=count($post) -1; $getcount=count($get) -1; $getkeys=array_keys($get); $postkeys=array_keys($post); while($getcount>0) { $key=$getkeys[$getcount]; $variable=$get[$key]; $variable=$variable1=trim(strtolower($variable)); $vnum=0; while($variable2=$variable1[$vnum]) { if(!strstr($alphabet,$variable2) \|\| $variable2=="\"") { $variable=str_replace($variable2,'',$variable); } $vnum=$vnum+1; } $_GET[$key]=$variable; $getcount=$getcount-1; } while($postcount>0) { $key=$postkeys[$postcount]; $variable=$post[$key]; $variable=$variable1=trim(strtolower($variable)); $vnum=0; while($variable2=$variable1[$vnum]) { if(!strstr($alphabet,$variable2) \|\| $variable2=="\"") { $variable=str_replace($variable2,'',$variable); } $vnum=$vnum+1; } $_POST[$key]=$variable; $postcount=$postcount-1; } ?>
If you need to check if the current user's IP address is either within a set range or matches a given IP use this function. Possible uses include additional security for an authentication script. IP range needs to be in form 12.34.56.78-12.34.67.89 function checkIPorRange ($ip_address) { if (ereg("-",$ip_address)) { // Range $ar = explode("-",$ip_address); $your_long_ip = ip2long($_SERVER["REMOTE_ADDR"]); if ( ($your_long_ip >= ip2long($ar[0])) && ($your_long_ip <= ip2long($ar[1])) ) { return TRUE; } } else { // Single IP if ($_SERVER["REMOTE_ADDR"] == $ip_address) { return TRUE; } } return FALSE; }
If you want to use PHP to display emails without fear of spambots taking them for ill-use, when you don't have an encryption algorithm, here is a simple and usefull tool to both hide and present emails with sessions and random encoding. This is how you can easily encode your emails on a webpage. This works by generating a unique password to attach to each email being encoded per page in a random place. To see a error, copy and paste a email link into a new window. <? /*** * * PHP email display and call by Michael Glazer http://coding.4arrow.com March 11, 2003 * * Let's Roll! * America Rules! * * You can freely use this script as long as this header remains intact * **/ // start session session_start ( ); // request being made if ( $argv[0] ) { // not allowed a direct request if ( $_SESSION['page'] != $_SERVER['HTTP_REFERER'] ) die ( 'Not Allowed!' ); // decode request $decode = base64_decode ( $argv[0] ); // strip our hidden random password $email = str_replace ( $_SESSION['key'] , '' , $decode ); // open mailto link and return to previous page then die die ( '<script>location.href=\'mailto:'.$email.'\'; location.href=\''.$_SESSION['page'].'\'</script>' ); } // our array of emails $emails = array('test1@yahoo.com','test2@yahoo.com'); // current page beign requested $_SESSION['page'] = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; // random generated password to append to a random place within each email $_SESSION['key'] = md5(microtime().posix_getpid()); // iteriate through each email append random key to random place in email foreach ( $emails as $k => $email ) { // encode email $encode = base64_encode ( posKey ( $email , $_SESSION['key'] ) ); // write email echo '<a href="emails.php?'.$encode.'">Email '.$k.'</a><br>'.chr(13); } // function to randomlly position our random password to each email function posKey ( $email , $key ) { $sep1 = '@'; $sep2 = '.'; $FS = explode ( $sep1 , $email , 2 ); $ST = explode ( $sep2 , $FS[1] , 2 ); $F = $FS[0]; // first $S = $ST[0]; // second $T = $ST[1]; // third $place = array('FB','FM','FE','SB','SM','SE','TB','TM','TE'); $placement = $place[rand(0, sizeof($place) -1)]; switch ( $placement ) { case 'FB': //first beginning return $key . $email; break; case 'FM': // first middle $len = strlen ($F); $half = ($len / 2); $front = substr($F,0,$half); $back = substr($F,$half); return $front . $key . $back . $sep1 . $FS[1]; break; case 'FE': // first ending return $F . $key . $sep1 . $FS[1]; break; case 'SB': // second beginning return $F . $sep1 . $key . $FS[1]; break; case 'SM': // second middle $len = strlen ($S); $half = ($len / 2); $front = substr($S,0,$half); $back = substr($S,$half); return $F . $sep1 . $front . $key . $back . $sep2 . $T; break; case 'SE': // second ending return $F . $sep1 . $S . $key . $sep2 . $T; break; case 'TB': // third beginning return $F . $sep1 . $S . $sep2 . $key . $T; break; case 'TM': // third middle $len = strlen ($T); $half = ($len / 2); $front = substr($T,0,$half); $back = substr($T,$half); return $F . $sep1 . $S . $sep2 . $front . $key . $back; break; case 'TE': // third ending return $email . $key; break; } } ?>
gencoder is a simple php encoder that use base64 algorithm to encode and decode the script, unlike zend encoder, this script won't solve your problem from hiding the source code from advance programmer but at least you're one step closer to making your code tougher for people to steal <? /============================================================ gencoder v1.0 copyright (c) 2001 ============================================================== gencoder is a simple php encoder that use base64 algorithm to encode and decode the script. the drawback of this script: - it doesn't have a key for encryption / decryption method. - run slower then normal php script (because it need to re-read the script and decode it). - only work on single complete php tag (one open php tag and one close php tag) because of limitation of eval function. unlike zend encoder, this script won't solve your problem from hiding the source code from advance programmer but at least you're one step closer to making your code tougher for people to steal. ============================================================== this is free software. you can redistribute it and/or modify it under the terms of the gnu general public license as published by the free software foundation. ============================================================== author: R. Galuh Prasetyo <rgprasetyo@yahoo.com> ============================================================/ //detects if launch from shell or browser if ($PHP_SELF != "") { //from browser if (!isset ($source)) { echo "Syntax: gencode.php?source=<php_sorce_script>[&dest=<php_dest_script>]"; exit; } if (!isset ($dest)) $dest = $source; } else { //from shell if (!isset ($HTTP_SERVER_VARS[argv][1])) { echo "\nSyntax: gencode.php <php_source_script> [php_dest_script]\n"; exit; } $source = $HTTP_SERVER_VARS[argv][1]; if (isset ($HTTP_SERVER_VARS[argv][2])) $dest = $HTTP_SERVER_VARS[argv][2]; } //retrieve source code $fs = fopen ($source, "r"); $code = fread ($fs, filesize ($source)); fclose ($fs); //check if source already encoded if (ereg ("^<\?/\gencoder", $code)) { echo "\nWarnning, \"$source\" already encrypted by gencode!!\n"; exit; } //remove php tag $code = eregi_replace("<\?\|<\?php\|\?>", "", $code); //encode by base64 $code = chunk_split (base64_encode ($code)); //generate encoded string $decript_code = 'if($PHP_SELF!="")$s=file($PATH_TRANSLATED);else$s=file($HTTP_SERVER_VARS[argv][0]);foreach($s as $l){if(ereg("^\/",$l))$b=false;if($b)$ss.=$l;if(ereg("^<\?/\gencoder",$l))$b=true;}eval(base64_decode($ss));?>'; $encoded = "<?/gencoder\n$code*/$decript_code"; //write encoded string to destination file $fd = fopen ($dest, "w"); fwrite ($fd, $encoded); fclose ($fd); ?>
Very simple functions to create a logins table in a mysql db, add hashed/encrypted usernames and passwords, and authenticate. <? function MakeTableLogins($database, $host, $db_user, $db_pass) {//create the logins table $linkID = mysql_connect($host, $db_user, $db_pass); mysql_select_db($database, $linkID); mysql_query("create table logins (user char(32), pasword char(32))", $linkID); } function Encrypt($string) {//hash then encrypt a string $crypted = crypt(md5($string), md5($string)); return $crypted; } function AddUser($database, $host, $db_user, $db_pass, $username, $password) { //add user to table logins $linkID = mysql_connect($host, $db_user, $db_pass); mysql_select_db($database, $linkID); $password = encrypt($password); $username = encrypt($username); mysql_query("insert into logins values ('$username', '$password')", $linkID); } function Login($database, $host, $db_user, $db_pass, $user, $password) { //attempt to login false if invalid true if correct $auth = false; $user = Encrypt($user); $linkID = mysql_connect($host, $db_user, $db_pass); mysql_select_db("$database", $linkID); $result = mysql_query("select password from logins where user = '$user'", $linkID); $pass = mysql_fetch_row($result); mysql_close($linkID); if ($pass[0] === (Encrypt($password))) { $auth = true; } return $auth; } ?>
Keycom Version2 (production tested)- This is a class to store values in a conacated string. This string can then be passed as a post variable to a child program. As the internals of the variable are not exposed this provides the most security. A companion script securepage.php checks for the existance of this post variable. The combination of the class and script allows for completely secure (cookie-less) www programing with spider friendly clean urs's. <?php // ******* License COMPLETELY FREE NO Guarantee **************** // keycom_class keycom_class_v2 - where security is essential. Cookieless passing of post variables. // This class will enable the user to pass all necessary variables in a // secure fasion to the child php page. // it accomplishes this by creating objects that search and or replace the // variables one desires to pass in a conacated string // This is shot # 2 on crating classes so beware // Thanks for your interest. Ian A. Stewart // ********** examples for use see bottom of listing ****** //$ikey = new keycom($tmcvars); // instantiate //$ikey->set_var_name('tkey'); // set the search variable //$ikey->find_val(); // execute the search //echo $ikey->ret_var_val(); // return the found search // the two below are the ones that set a new key value and return it //$ikey->set_tkey('tband_rsn',88); // set a [key] value //echo $ikey->ret_key_val(); // return the [key] strinn // $ikey->find_n_return('etclike') // returns the value of etclike // file settings.php $tmcvars = "junk\|0\|tkey\|012243\|variable2\|value2\|b\|0\|etclike\|test\|etcgiving\|0\|etcout\|0\|my\|0\|variables\|0" ; // see the format is variable\|value the seperator is the "\|" charactor // added junk to the first field to take care of bug // see bottom for examples of use [by Ian A. Stewart] World Multcast.inc // //include_once '../someincludepath/yoursettings.php'; put your vars shown above in your settings file class keycom {// class block begin var $tmcvars = ""; var $var_name = ""; var $var_val = ""; function find_n_return($bx){ $this->set_var_name($bx); $this->find_val(); return $this->var_val; } function keycom($tmcvars) { //echo "Master Data Set to $tmcvars <br>"; $this->tmcvars = $tmcvars; //$this->a = explode('\|',$this->tmcvars); } function set_var_name($var_name){ $this->var_name = $var_name; } function set_tkey($key_val,$new_val){ $a = explode('\|',$this->tmcvars); $xx = 0; //echo $a[1]; while (isset($a[$xx])) { //echo $key_val; if ($a[$xx] == $key_val) { $a[$xx + 1] = $new_val; $this->tmcvars = implode('\|',$a); }// echo $a[$xx]; echo '<br>'; $xx++; } } function ret_var_val(){ return $this->var_val; } function ret_key_val(){ return $this->tmcvars; } function find_val() { //echo $this->var_name; $a = explode('\|',$this->tmcvars); $xx = 0; //echo 'test'.$a[1]; while (isset($a[$xx])) { if ($a[$xx] == $this->var_name) { $this->var_val = $a[$xx + 1]; return $this->var_val; //echo $a[$xx]; echo '<br>'; } $xx++; } } } // class block end // *************************** // Examples // no Copyright no Guarantee // // these three below allow you to look up a variable valeu $ikey = new keycom($tmcvars); // instantiate echo "instantiated value = "; echo $ikey->ret_key_val().'<br>'; // echo $ikey->find_n_return('etclike').'<br>'; // return the found search // // the two below are the ones that set a new key value and return it $ikey->set_tkey('etclike',88); // set a [key] value (notice the output) echo $ikey->ret_key_val(); // return the whole [key] string ?>
// ******* License COMPLETELY FREE NO GUARENTEE **************** // keycom_class - where security is essential. Cookieless passing of post variables. // This class will enable the user to pass all necessary variables in a // secure fasion to the child php page. // it accomplishes this by creating objects that search and or replace the // variables one desires to pass in a conacated string // This is shot # 2 on creating classes so beware // Thanks for your interest. Ian A. Stewart <?php // ***** License COMPLETELY FREE NO GUARENTEE **************** // keycom_class - where security is essential. Cookieless passing of post variables. // This class will enable the user to pass all necessary variables in a // secure fasion to the child php page. // it accomplishes this by creating objects that search and or replace the // variables one desires to pass in a conacated string // This is shot # 2 on crating classes so beware // Thanks for your interest. Ian A. Stewart // ********** examples for use see bottom of listing ****** //$ikey = new keycom($tmcvars); // instantiate //$ikey->set_var_name('tkey'); // set the search variable //$ikey->find_val(); // execute the search //echo $ikey->ret_var_val(); // return the found search // the two below are the ones that set a new key value and return it //$ikey->set_tkey('tband_rsn',88); // set a [key] value //echo $ikey->ret_key_val(); // return the [key] strinn // // file settings.php $tmcvars = "tkey\|012243\|variable2\|value2\|b\|0\|etclike\|0\|etcgiving\|0\|etcout\|0\|my\|0\|variables\|0" ; // see the format is variable\|value the seperator is the "\|" charactor // // see bottom for examples of use [by Ian A. Stewart] World Multcast.inc // //include_once '../someincludepath/yoursettings.php'; put your vars shown above in your settings file class keycom {// class block begin var $tmcvars = ""; var $var_name = ""; var $var_val = ""; function keycom($tmcvars) { //echo "Master Data Set to $tmcvars <br>"; $this->tmcvars = $tmcvars; //$this->a = explode('\|',$this->tmcvars); } function set_var_name($var_name){ $this->var_name = $var_name; } function set_tkey($key_val,$new_val){ $a = explode('\|',$this->tmcvars); $xx = 0; //echo $a[1]; while (isset($a[$xx])) { //echo $key_val; if ($a[$xx] == $key_val) { $a[$xx + 1] = $new_val; $this->tmcvars = implode('\|',$a); }// echo $a[$xx]; echo '<br>'; $xx++; } } function ret_var_val(){ return $this->var_val; } function ret_key_val(){ return $this->tmcvars; } function find_val() { //echo $this->var_name; $a = explode('\|',$this->tmcvars); $xx = 0; //echo 'test'.$a[1]; while (isset($a[$xx])) { if ($a[$xx] == $this->var_name) { $this->var_val = $a[$xx + 1]; return $this->var_val; //echo $a[$xx]; echo '<br>'; } $xx++; } } } // class block end // *************************** // Examples // no copyright no guarentee // // these three below allow you to look up a variable value $ikey = new keycom($tmcvars); // instantiate $ikey->set_var_name('tkey'); // set the search variable $ikey->find_val(); // execute the search echo $ikey->ret_var_val(); // return the found search // the two below are the ones that set a new key value and return it $ikey->set_tkey('etclike',88); // set a [key] value (notice the output) echo $ikey->ret_key_val(); // return the [key] string ?>
All you need is this include file and a control statement on any page you wish to authenticate users from. <?php //FOREWORD/////////////////////////////////////////////////////////////////////////////////////////// //*Please read considerations* //*This script was written by Russell Hanby, a php-scriptkiddie. //Russell says: "Use it and modify it at your discretion. I want to learn, so help me out. //** Comments? Critiques? Email me: russellhanby@yahoo.com. Thanx and enjoy." // HOW IT WORKS: // The goal of login.inc was to create an authentication scheme that was as secure as my novice // abilities could make it, and also easy to use on any page. The core of the scheme is the token // object which stores several authentication variables. These variable include a username, // password, timestamp, remote addr, remote hostname, and session_id. Alone, these variable are // seemingly arbitrary because any one of them could be potentially forged. However, when combined // and compared against multiple sources, these variables create a strong scheme with which to // authenticate users. //CONTENTS: // FUNCTIONS: login_check(), ssl_redirect(), login(), enc_token(), dec_token(), valid_token(), // create_token(), get_key(), submitting(), form_input_check(), loggin_in(), logged_in(), // process_user_pass() // CLASSES: token // //WHAT YOU NEED: // FILES: user_pass file, key file // MODULES: mcrypt support // //CONSIDERATIONS: // Encryption - the encryption used for the token is RIJNDAEL_256. The key is derived "randomly" // each time the enc_token() function is called by first picking a random "key coordinate" and then // passing this $kc to the get_key() function. This function opens the key_file and extracts a 32 // character key starting at the $kc point in the file. The beauty of this is that the token // never appears the same, the token is cookie safe, and the key_file can be changed at anytime. // Key File- a file containing 10,000 "random" ASCII characters in the 32 to 255 range. This // file can be created and recreated with the following code: // function create_key_file() // { // $path = 'c:\path\to\key_file.ext'; // if(!fopen($path, "w")) echo("file write failed"); // else // { // $counter = 1; // while($counter < 10000) // { // $chr = chr(mt_rand(33,255)); // fwrite($file,$chr); // $counter += 1; // } // fclose($file); // } // } // SSL - checking for ssl and appropriately redirecting is supported. Simply uncomment the lines in // the login_check() function and the ssl_redirect() function. // SESSION - session_start() is called at the beggining of the file, so consider this when writing // session code outside of the file. // PROCESS_USER_PASS - this function does not account for the use of salt with the stored usernames // and passwords. This functionality can be added by adding a $salt variable to the function. // LOGIN - the login_check() function is set up to display a default login form if the user is not // authenticated or if the user has not logged in. You can edit this form and the way it is // displayed by editing both functions. Also, it may be helpful to move the login() function call // outside of the login_check() function, and include it in your control on your page. // // HOW TO USE LOGIN.INC: // (1) create user_pass file - storing usernames and passwords in the following format: // "user:pass\n\r", where user and pass are the md5 hashs (without salt) of the valid users, and // "\n\r" is the new line delimiter. // (2) create key_file - use the function above to create such a file. If you choose to use your // own key_file, make sure to edit the get_key() function to account for a different size of file. // Also, you can recreate a new key_file (for added security) at any time using this function. // (3) login.inc - include the file at the beggining of any page you wish to require // authentication. // (4) login_check - add control to page after include. For example: // if(login_check()) { insert code if user is authenticated; } // else { insert code if user is not authenticated; } // (5) you're done! ///////////////////////////////////////////////////////////////////////////////////////////////////// session_start(); ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : login_check; // Function Purpose: determines status of user and //calls appropriate functions; // Recieves : nothing; // Returns : bool; ///////////////////////////////////////////////////////////////////////////////////////////////////// function login_check() { if(logged_in()) { if(valid_token()) { return true; } else return false; } elseif(logging_in()) { if(process_user_pass(md5($_POST['USER']),md5($_POST['PASS']))) { create_token(); unset($_POST['USER']); unset($_POST['PASS']); return true; } else { //If using ssl for login, uncomment the following if statement and //edit ssl_redirect function /if($_SERVER['HTTPS']=="off") ssl_redirect(); else /login($_SERVER['PHP_SELF']); return false; } } else { //If using ssl for login, uncomment the following if statement and //edit ssl_redirect function /if($_SERVER['HTTPS']=="off") ssl_redirect(); else /login($_SERVER['PHP_SELF']); return false; } } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : ssl_redirect; // Function Purpose: redirects user to a secure //connection; // Recieves : nothing; // Returns : nothing; ///////////////////////////////////////////////////////////////////////////////////////////////////// function ssl_redirect() { /$url1 = "https://"; $url2 = $_SERVER['SERVER_NAME']; $url3 = $_SERVER['PHP_SELF']; $url = "$url1$url2$url3"; //either display link for redirection //echo("You must login over a secure connection...<BR>"); //echo("<A HREF=$url>Click here for a secure connection</A>"); //or use header function to redirect //header("location: $url"); //or insert your own code here/ } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : login; // Function Purpose: displays login form with provided //action, which is just PHP_SELF, unless // otherwise specified; // Recieves : $act - action for processing login //form; // Returns : nothing; ///////////////////////////////////////////////////////////////////////////////////////////////////// function login($act) { $loginform = "<STYLE TYPE=text/css REL=stylesheet> .loginbox { display: block; position: relative; height: 110px; width: 300px; font-family: arial; color: blue; border: solid 1px blue; text-align: center; padding: 8px;} .header { text-align: center; font-size: 16; font-weight: bold; color: blue; background-color: #FFD700; padding: 2px; border: solid 1px blue;} .button { width: 60px; border: solid 1px blue; color: blue; background: white; cursor: pointer; border: inset 1px blue; padding: 2px;} </STYLE> <FORM CLASS=loginbox METHOD=post ACTION=$act> <TABLE ALIGN=center> <TR><TD ALIGN=center COLSPAN=2 CLASS=header>Log in...</TD></TR> <TR><TD>User:</TD><TD><INPUT TYPE=text SIZE=25 MAXLENGTH=20 NAME=USER></TD></TR> <TR><TD>Pass:</TD><TD><INPUT TYPE=password SIZE=25 MAXLENGTH=25 NAME=PASS></TD></TR> <TR><TD ALIGN=center COLSPAN=2><INPUT TYPE=submit NAME=LOGIN VALUE=LOGIN CLASS=button></TD></TR> </TABLE> </FORM>"; echo($loginform); } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Class Name : token; // Class Purpose: stores variables for validation; // Recieves : $u - plaintext username; // $p - plaintext password; // $s - session id; // $t - time stamp; // $h - hostname of remote //user; // $a - ip of remote user; // Returns : nothing; // Consideration: username and password are stored //in plaintext so that they can be used for other // functions if necessary; ///////////////////////////////////////////////////////////////////////////////////////////////////// class token { private $user; private $pass; private $sess_id; private $time_stamp; private $host; private $addr; function __construct($u,$p,$s,$t,$h,$a) { $this->user = $u; $this->pass = $p; $this->sess_id = $s; $this->time_stamp = $t; $this->host = $h; $this->addr = $a; } function user() { return $this->user; } function pass() { return $this->pass; } function time_stamp() { return $this->time_stamp; } function sess_id() { return $this->sess_id; } function host() { return $this->host; } function addr() { return $this->addr; } } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : enc_token; // Function Purpose: serializes, encrypts, and then //base64 encodes bare token object for storage; // Recieves : $o - token object; // Returns : $enc_token - encoded/encrypted //token string; ///////////////////////////////////////////////////////////////////////////////////////////////////// function enc_token($o) { $ser_token = serialize($o); $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC); $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND); $kc = mt_rand(0, 99968); $_SESSION['KC'] = $kc; $key = get_key($kc); $crypt_token = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $ser_token, MCRYPT_MODE_CBC, $iv); $enc_token = base64_encode($crypt_token); return $enc_token; } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : dec_token; // Function Purpose: base64 decodes, decrypts, and //then unserializes token string; // Recieves : $str - encoded/encrypted string; // Returns : $unser_token - token object; ///////////////////////////////////////////////////////////////////////////////////////////////////// function dec_token($str) { $dec_token = base64_decode($str); $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC); $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND); $kc = $_SESSION['KC']; $key = get_key($kc); $decrypt_token = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $dec_token, MCRYPT_MODE_CBC, $iv); $unser_token = unserialize($decrypt_token); return $unser_token; } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : valid_token; // Function Purpose: validates token against SESSION //and SERVER variables,as well as user_pass file; // Recieves : nothing; // Returns : bool; ///////////////////////////////////////////////////////////////////////////////////////////////////// function valid_token() { $enc_token = $_SESSION['TOKEN']; $dec_token = dec_token($enc_token); $sess_id = session_id(); $timestamp = $_SESSION['TIME_STAMP']; $host = $_SERVER['REMOTE_HOST']; $addr = $_SERVER['REMOTE_ADDR']; $token_timestamp = $dec_token->time_stamp(); $token_sess_id = $dec_token->sess_id(); $token_user = md5($dec_token->user()); $token_pass = md5($dec_token->pass()); $token_host = $dec_token->host(); $token_addr = $dec_token->addr(); if($timestamp == $token_timestamp and $sess_id == $token_sess_id and $host == $token_host and $addr == $token_addr and process_user_pass($token_user,$token_pass)==true) return true; else return false; } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : create_token; // Function Purpose: creates token object, calls //enc_token, and stores token in SESSION; // Recieves : nothing; // Returns : bool; ///////////////////////////////////////////////////////////////////////////////////////////////////// function create_token() { $date = getdate(); $_SESSION['TIME_STAMP'] = $date; $sess_id = session_id(); $user = $_POST['USER']; $pass = $_POST['PASS']; $host = $_SERVER['REMOTE_HOST']; $addr = $_SERVER['REMOTE_ADDR']; $token = new token($user,$pass,$sess_id,$date,$host,$addr); $enc_token = enc_token($token); $_SESSION['TOKEN'] = $enc_token; } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : get_key; // Function Purpose: gets key from key_file using "key //coordinate" // Recieves : $kc - "key coordinate"; // Returns : $key - key from file(upon success); // false(upon failure); ///////////////////////////////////////////////////////////////////////////////////////////////////// function get_key($kc) { //CONSIDERATION: there is no error checking for a failed read on the key_file, the function //will simply return false upon failure, so make sure your key_file is being read properly, or //add control statement in enc/dec_token functions. $path = 'C:\path\to\key_file.ext'; if(!$file = fopen($path,'r')) return false; else { $start = $kc; fseek($file,$start); $key = fgets($file,33); fclose($file); return $key; } } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : submitting; // Function Purpose: determines if a user is submitting //a form; // Recieves : nothing; // Returns : bool; ///////////////////////////////////////////////////////////////////////////////////////////////////// function submitting() { if(!isSet($_POST['USER']) or !isSet($_POST['PASS']) or !isSet($_POST['LOGIN'])) return false; else return true; } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : form_input_check; // Function Purpose: ensures form input is semi-valid; // Recieves : nothing; // Returns : bool; ///////////////////////////////////////////////////////////////////////////////////////////////////// function form_input_check() { //If you wish, you may insert your own code to scrutinize form_input more thoroughly if($_POST['USER'] == "" or strlen($_POST['USER']) > 20) return false; elseif($_POST['PASS'] == "" or strlen($_POST['PASS']) > 25) return false; else return true; } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : loggin_in; // Function Purpose: runs functions to determine if a //user is logging in; // Recieves : nothing; // Returns : bool; ///////////////////////////////////////////////////////////////////////////////////////////////////// function logging_in() { if(!submitting()) return false; elseif (!form_input_check()) return false; else return true; } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : logged_in; // Function Purpose: determines if a user is logged in; // Recieves : nothing; // Returns : bool; ///////////////////////////////////////////////////////////////////////////////////////////////////// function logged_in() { if(!isset($_SESSION['Token']) or !isset($_SESSION['TIME_STAMP']) or !isset($_SESSION['KC'])) return false; else return true; } ///////////////////////////////////////////////////////////////////////////////////////////////////// // Function Name : process_user_pass; // Function Purpose: validates username and password //against user_pass_file // Recieves : $u - md5 hash of username; // $p - md5 hash of password; // Returns : bool; ///////////////////////////////////////////////////////////////////////////////////////////////////// function process_user_pass($u,$p) { //CONSIDERATION: if users are not able to be //validated, make sure user_pass_file is being //read properly. Also, this function assumes //usernames and passwords are stored in the following //manner- '$u:$p\n\r' $path = 'C:\path\to\user_pass_file.ext'; if(!$file = fopen($path,"r")) { return(false); } while(!feof($file)) { $line = fgets($file, 67); $user_pass = explode(":",$line); list($parseduser, $parsedpass) = $user_pass; $parsedpass = trim($parsedpass); if($parseduser==$u && $parsedpass==$p) { fclose($file); return(true); } } fclose($file); return(false); } ///////////////////////////////////////////////////////////////////////////////////////////////////// ?>
If you are making a admin tool for your site you can add all the users into a table called e.g. "users" and automaticaly generate a .htpasswd file from it. This function uses MD5 encryption. function makehtaccess() { global $Cfg; connect(); $users = mysql_query("select username,pass from users where access > '0'") or die ("Can't get users (makehtaccess)"); $num = mysql_numrows($users); $t = 0; if ($num != 0) { $f = fopen(".htpasswd", "w+"); while ($num>$t) { unset($seed); # generate random seed $all = explode( " ", "a b c d e f g h i j k l m n o p q r s t u v w x y z " . "A B C D E F G H I J K L M N O P Q R S T U V W X Y Z " . "0 1 2 3 4 5 6 7 8 9"); for($i=0;$i<9;$i++) { srand((double)microtime()*1000000); $randy = rand(0, 61); $seed .= $all[$randy]; } $username = mysql_result($users,$t,"username"); $password = mysql_result($users,$t,"pass"); $crypt = crypt($password, "\$1$$seed"); fputs($f,"$username:$crypt\n"); $t++; } } }
Simple code for a secure login and low over head to boot. And dammit it just plan works lol. <? # Login Code Written by Matt Slavin # Email Me At neophite17@hotmail.com for questions or comments. if((!$Username) \| (!$Password)) { print ("Please Enter In THe Correct Name"); } mysql_connect("localhost","User_Name_here","Password_Here"); mysql_select_db("My_Database_Here"); # This part is sort if ya want to. I would suggest it. # Make your login page have the main value of Password #Comment Out if you Want too $Password = md5($Password); $sql = "select * from My_Table where Password=$Password and Username=$Username"; $result = mysql_query($sql); $num = mysql_numrows($result); # If Login Is Okay Do What You Want TO DO to Them if ($num == "1") { print ("Logged in okay"); #Or you can send them somwhere nice like hawaii header("Location: http://www.hawii"); exit; # or even fetch feild about them or save sessions session_start(); session_register(Username); } # And we must a have a default error message if login fails if ($num == "0"){ print ("Sorry Bub You Need Some Manners In Password"); } ?>
A Membership section for your website. It still needs the signup section. If you have any problems... shane@mics.co.za #index.php <? #Membership Site V1.1 #This is a secure login form agains't a MySQL database #Written by Shane James(flipside) #mailto shane@phpboy.co.za #This is the Config of the main login file # Location of the authentification file $authfile = "/usr/home/ccn/public_html/authenticate.php"; #End config #This checks if the form has been submited by the form yet if ($auth != "authenticate"){ echo "<form method=post action=index.php>"; echo "Written by Shane James(flipside)<br>"; echo "Secure log in against an encrypted MySQL database<br><br>"; echo "Membership Site V1.1<br>"; echo "<li>Created More Accurate Error Messages</li>"; echo "<li>Fixed login Bug</li>"; echo "<li>Fixed Session Bug</li><br><br>"; echo "Login: test<br>"; echo "Password: testpass"; echo "<table>"; echo "<tr><td>Login :</td><td> <input type=text name=username></td></tr>"; echo "<tr><td>Password :</td><td> <input type=text name=password></td></tr></table>"; echo "<input type=hidden name=auth value=authenticate>"; echo "<div align=left><input type=submit value=\"Log In\"></div>"; echo "</form>"; } #This does the secure authentication if ($auth == "authenticate"){ require("$authfile"); if ($username != "$realuser"){ echo "Username <b>$username</b> does not excist"; } if($username == ""){ echo "Please fill in a username"; } if($password == ""){ echo "<br>Please fill in your password"; } elseif ($username == "$realuser"){ if ($confirmpass == "1"){ session_start(); session_register(loggedin); $loggedin = "98127398abasdfiu98123nius"; $PHPSESSID = session_id(); $SID = session_id(); echo "<head>"; echo "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"0;URL=member/index.php?SID=$SID\">"; echo "</head>"; } else { echo "<br>Wrong password"; } } } ?> #authenticate.php <? #Membership Site V1.1 #This is a secure login form agains't a MySQL database #Written by Shane James(flipside) #mailto shane@mics.co.za #This is the authentification function #Mysql Configfile Location $mysqlconfigfile = "mysql.php"; require('/usr/home/ccn/public_html/mysql.php'); $authenticateuser = "select * from $db_name where username = '$username'"; mysql_connect("$db_host", "$db_user", "$db_pass"); $result = mysql_db_query("$db_name", $authenticateuser); while ($row = mysql_fetch_array($result)){ $realuser = $row["username"]; } $authenticatepass = "select * from $db_name where password = password('$password') and username = '$username'"; $query = mysql_query($authenticatepass); $confirmpass = mysql_numrows($query); ?> #mysql.php <? #Membership Site V1.1 #This is a secure login form agains't a MySQL database #Written by Shane James(flipside) #mailto shane@mics.co.za #This is the MySQL config file #Database Hostname $db_host = "localhost"; #Database Username $db_user = "mics"; #Database Password $db_pass = "mics012"; #Database Name $db_name = "mics"; ?> #logout/index.php <? #Membership Site V1.1 #This is a secure login form agains't a MySQL database #Written by Shane James(flipside) #mailto shane@mics.co.za session_start(); session_unset(); session_destroy(); echo "you've just loged out!"; ?> #member/index.php <? #Membership Site V1.1 #This is a secure login form agains't a MySQL database #Written by Shane James(flipside) #mailto shane@mics.co.za #This is the actual members page session_start(); if($loggedin == "98127398abasdfiu98123nius"){ session_start(); if($SID == $PHPSESSID){ echo "If you can see this page, you've logged in correctly"; echo "<br><a href=../logout/index.php?logout=logout>click here to log out</a>"; } #session_start(); #if($loggedin != "98127398abasdfiu98123nius"){ #echo "You are not currently logged in...please log in"; #} else{ echo "You do not seem to be logged in correctly, Please login"; session_start(); session_unset(); session_destroy(); } } else { echo "You do not seem to be logged in correctly, Please login"; session_start(); session_unset(); session_destroy(); } ?>
Authentication and page permission using session variable. <?php ///////////////////////////////////////////////////////////// // // MSD_lib.inc.php // (c) Maresa Nirwan mnirwan@microshell.net // ///////////////////////////////////////////////////////////// function require_login($auth = "7") { global $s_domain_name; global $HTTP_SESSION_VARS; // Check if user is login. if (!is_login()) { header("Location: http://$s_domain_name/login.html"); } else { // User is logged in. if ($val == "employee") { $db = mysql_pconnect("localhost","username","password"); mysql_select_db("DB"); $result = mysql_query("SELECT permission FROM customer_tbl WHERE session_id = '".$HTTP_SESSION_VARS["sv_login"]."'"); if (mysql_num_rows != 1) { // Something's wrong echo "<center><font color=\"red\" size=\"+2\">Something is wrong. Query returns 0 or more than 1 result.</font></center>"; exit; } $row = mysql_fetch_array($result); $auth_scheme = $row["permission"]; $is_ok = $auth & $auth_scheme; if ($is_ok == $auth) { $is_ok = TRUE; } else { echo "<center><font color=\"red\" size=\"+2\">Sorry!!! You don't have permission to access this page.</font></center>"; exit; } } else { $is_ok = TRUE; // There's no permission level on customer user's pages } } } function is_login() { // Will check if a user is logged in or not global $HTTP_SESSION_VARS; // The function will return login_id if user is logged in if (isset($HTTP_SESSION_VARS["sv_login"])) { // The user is logged in $db = mysql_pconnect("localhost","username","password"); mysql_select_db("DB"); $result = mysql_query("SELECT customer_id FROM customer_tbl WHERE session_id = '".$HTTP_SESSION_VARS["sv_login"]."'"; if (mysql_num_rows($result) == 1) { $row = mysql_fetch_array($result); return $row["customer_id"]; } else { return FALSE; } } else { // The user is not logged in return FALSE; } } function parse_get_post($var_name) { // Will check if one of GET or POST exist. If it is, global $HTTP_GET_VARS; // the function will return that variable global $HTTP_POST_VARS; // returns empty if none is defined if (isset($HTTP_GET_VARS["$var_name"])) { return $HTTP_GET_VARS["$var_name"]; } else if (isset($HTTP_POST_VARS["$var_name"])) { return $action = $HTTP_POST_VARS["$var_name"]; } else { return ""; } } /******** END MSD_lib.inc.php *******/ ?> <?php ///////////////////////////////////////////////////////////// // // MSD_login.php // (c) Maresa Nirwan mnirwan@microshell.net // // This file takes 5 arguments // 1. login ------------ User input login name // 2. password ------------ User input password // 3. action ------------ Specifies the action to login or logout people // 4. location ------------ Specifies what page to show after login/logout complete // 5. login_btn ------------ If not exist, display login page // ///////////////////////////////////////////////////////////// // Theese 3 vars can be passed either by get or post method. $action = parse_get_post("action"); $location = parse_get_post("location"); $login_btn = parse_get_post("login_btn"); // Check if login button is defined. If not, display login page. if (strlen($login_btn) == 0) { header("Location: http://$s_domain_name/login.html"); exit; } // Default action to logout if (strlen($action) == 0) { $action = "logout"; } if (strlen($location) == 0) { $location = $s_domain_name . "/"; } $location = urldecode($location); // ------ Done parsing vars now we can do the stuff if ($action == "login") { $db = mysql_pconnect("localhost","username","password"); mysql_select_db("DB"); $password = md5($HTTP_POST_VARS["password"]); $result = mysql_query("SELECT employee_id FROM employee_tbl WHERE login = '".$HTTP_POST_VARS["login"]."' AND password = '$password'"); if (mysql_num_rows($result) != 1) { // Bad Login header("Location: http://$s_domain_name/login.html"); exit; } else { srand((double)microtime()1000000); $login_id = md5(uniqid(rand())); $mysql_query("UPDATE employee_tbl SET session_id = '$login_id' WHERE employee_id = '".$db->f("employee_id")."'"); $HTTP_SESSION_VARS["sv_login"] = "$login_id"; // Done authenticating and loging in user. Now redirect user to another page. header("Location: http://$s_domain_name/msd/admin/$location"); } } else { // Logging out user $db = mysql_pconnect("localhost","username","password"); mysql_select_db("DB"); $mysql_query("UPDATE employee_tbl SET session_id = '' WHERE session_id = '".$HTTP_SESSION_VARS["sv_login"]."'"); $HTTP_SESSION_VARS["sv_login"] = ""; header("Location: http://$s_domain_name/msd/admin/$location"); } /******** END MSD_login.php ******/ ?> ************* SAMPLE login.html *************** -- begin login.html -- <html> <head> <title>MSD Login Screen</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> </head> <body bgcolor="#FFFFFF"> <form method="post" action="MSD_login.php"> Login Name: <input type="text" name="login"><br> Password: <input type="password" name="password"><br> <input type="hidden" name="action" value="login"> <input type="hidden" name="location" value="main_screen.html"> <input type="submit" name="login_btn" value="Login"> </form> </body> </html> -- end login.html -- For database, I assume you have employee_tbl with at least theese fields defined: login, password, session_id, and permission. permission fields should contain decimal representation of binary number. e.g. 1 is regular user. on database stored as 1 (2 to the power of 0) 11 is power user. on database stored as 3 (2 to the power of 1 plus 2 to the power of 0) 111 is super user. on database stored as 7. You figure out why 7. :-) On every page that you want user to login and have proper permission to view it, start session on every page and register variable sv_login and include MSD_lib.inc.php and call function require_login("1") for everyone that can login to be able to see page, require_login("3") for only power user and super user to be able to see page. require_login("7") for only super user to be able to see page.
Uses the .htpasswd to authenticate access to your PHP script Download class from http://phpclasses.upperdesign.com/browse.html/package/387
************************************************************************** * PHP Protect Plus * * v 1.0 * * www.phpclub.site.ir * ************************************************************************ To protect your html pages, first copy this file to the page's directory then rename html page to .php and add the line bellow to the first line of your html page: [ Replace "protect.php" with the name of this file ] Also for php files, just add the above line to the first line of code. The first time, use "admin" for username and "phpclub" for password. "admin" user is just for managing users. It can not be used for browsing protected pages. If you want to make a logout link, link to : "protect.php?logout=1" or any protected .php file with "?logout=1" . <?php // Config : [ You must set these options ] $sql_host = "localhost" ; // MySQL host $sql_user = "user" ; // MySQL username $sql_pass = "pass" ; // MySQL password $sql_db = "dbname" ; // Database name // End of config // $link = mysql_connect ($sql_host, $sql_user, $sql_pass) or die("Could not connect : " . mysql_error()); mysql_select_db ($sql_db) or die ("Could not select database '{$sql_db}' ."); $query = "SHOW TABLES FROM $sql_db" ; $r = mysql_query ($query) or die ("Query failed : " . mysql_error()); $dbase = 0 ; while ($row = mysql_fetch_row($r)) if ($row[0]=="protect_users") $dbase = 1 ; if ($dbase != 1) { $query = "CREATE TABLE protect_users (id CHAR(20), passwd CHAR(34))" ; $r = mysql_query($query) or die("Query failed : " . mysql_error()); $pass = crypt('phpclub', 'pc') ; $query = "INSERT INTO protect_users VALUES ('admin', '{$pass}')"; $r = mysql_query($query) or die("Query failed : " . mysql_error()); } login_check() ; if(isset($_GET['logout'])) protect_logout() ; if($_COOKIE['protect_user']=='admin') protect_admin() ; /**** Functions : *****/ function login_check() { global $link ; if (!isset($_COOKIE['protect_user']) \|\| !isset($_COOKIE['protect_passwd'])) login_get() ; $chars = count_chars($_COOKIE['protect_user']) ; if($chars[0] \|\| $chars[ord("'")]) { setcookie("protect_user", '', time(), '/') ; die('Alarm !') ; } $user = addslashes($_COOKIE['protect_user']) ; $passwd = $_COOKIE['protect_passwd'] ; $query = "SELECT FROM protect_users WHERE id = '{$user}'"; $rr = mysql_query($query) or die("Query failed : " . mysql_error()); if (mysql_num_rows($rr) == 0) login_get() ; // user_not_found() $row = mysql_fetch_assoc($rr) ; if($row["passwd"] != $passwd) login_get() ; // password_error() } function login_get() { if (isset($_POST['user']) && isset($_POST['passwd'])) { setcookie("protect_user", $_POST['user'], time()+864000, '/') ; setcookie("protect_passwd", crypt($_POST['passwd'], 'pc'), time()+864000, '/') ; die("<meta http-equiv='refresh' content='0; url=?'><a href='?'>Wait ...</a>") ; } echo "<html><head><title>Login</title><style type='text/css'>TD, .in {font-size: 12}</style></head><body><table width='100%'><tr><td align='center'><table>" ; echo "<form action='?' method='post'>" ; echo "<tr><td>Username :</td><td><input name='user'></td></tr>" ; echo "<tr><td>Password :</td><td><input type='password' name='passwd'></td></tr>\r\n" ; die("<tr><td> </td><td align='center'><input type='submit' name='Login' value='Login'></td></tr></form></table></td></tr></table></body></html>") ; } function protect_admin() { echo "<html><head><title>Admin Section</title><style type='text/css'>TD {font-size: 12}</style></head><body><table width='100%'><tr><td align='center'>" ; if (isset($_POST['add_user']) && isset($_POST['add_passwd'])) add_user($_POST['add_user'], $_POST['add_passwd']) ; elseif (isset($_POST['chg_user']) && isset($_POST['chg_passwd'])) chg_user($_POST['chg_user'], $_POST['chg_passwd']) ; elseif (isset($_POST['del_user'])) del_user($_POST['del_user']) ; elseif (isset($_POST['list_users'])) list_users() ; echo "<table><form action='?' method='post'>" ; echo "<tr><td colspan=2><font color=blue><b>Add a New User</b></font></td></tr>" ; echo "<tr><td>Username :</td><td><input name='add_user'></td></tr>" ; echo "<tr><td>Password :</td><td><input type='password' name='add_passwd'></td></tr>\r\n" ; echo "<tr><td> </td><td align='center'><input type='submit' name='add' value='Add'><hr></td></tr></form>" ; echo "<form action='?' method='post'>" ; echo "<tr><td colspan=2><font color=blue><b>Change Users Info</b></font></td></tr>" ; echo "<tr><td>Username :</td><td><input name='chg_user'></td></tr>" ; echo "<tr><td>New Pass :</td><td><input type='password' name='chg_passwd'></td></tr>\r\n" ; echo "<tr><td> </td><td align='center'><input type='submit' name='chg' value='Update'><hr></td></tr></form>" ; echo "<form action='?' method='post'>" ; echo "<tr><td colspan=2><font color=blue><b>Delete a User</b></font></td></tr>" ; echo "<tr><td>Username :</td><td><input name='del_user'></td></tr>" ; echo "<tr><td> </td><td align='center'><input type='submit' name='chg' value='Delete'><hr></td></tr></form>" ; echo "<form action='?' method='post'>" ; echo "<tr><td colspan=2><font color=blue><b>List All Users</b></font></td></tr>" ; echo "<tr><td> </td><td align='center'><input type='hidden' name='list_users' value='1'><input type='submit' name='lst' value='List Users'><hr></td></tr></form>" ; die("</form></table><hr width=50%>[ <a href='?logout=1'>Logout</a> ]</td></tr></table></body></html>") ; } function add_user($u, $p) { global $link ; $chars = count_chars($u) ; if($chars[0] \|\| $chars[ord("'")] \|\| !$u \|\| !$p) { die('Bad username/password .') ; } $query = "SELECT * FROM protect_users WHERE id = '{$u}'"; $rr = mysql_query($query) or die("Query failed : " . mysql_error()); if (mysql_num_rows($rr) != 0) { echo('<font color=red>User already exists .</font><hr width=50%>') ; return ; } $pass = crypt($p, 'pc') ; $query = "INSERT INTO protect_users VALUES ('{$u}', '{$pass}')"; $r = mysql_query($query) or die("Query failed : " . mysql_error()); echo "<font color=red>User added .</font><hr width=50%>" ; } function chg_user($u, $p) { global $link ; $chars = count_chars($u) ; if($chars[0] \|\| $chars[ord("'")] \|\| !$u \|\| !$p) { die('Bad username/password .') ; } $query = "SELECT * FROM protect_users WHERE id = '{$u}'" ; $rr = mysql_query($query) or die("Query failed : " . mysql_error()); if (mysql_num_rows($rr) == 0) { echo('<font color=red>User doesnt exist .</font><hr width=50%>') ; return ; } $pass = crypt($p, 'pc') ; $query = "UPDATE protect_users SET passwd = '{$pass}' WHERE id = '{$u}'"; $r = mysql_query($query) or die("Query failed : " . mysql_error()); echo "<font color=red>User changed .</font><hr width=50%>" ; if ($u=='admin') { die("<meta http-equiv='refresh' content='2; url=?'><a href='?'>Wait ...</a>") ; } } function del_user($u) { global $link ; if ($u=='admin') die("User 'admin' can not be deleted .") ; $chars = count_chars($u) ; if($chars[0] \|\| $chars[ord("'")] \|\| !$u) { die('Bad username .') ; } $query = "SELECT * FROM protect_users WHERE id = '{$u}'" ; $rr = mysql_query($query) or die("Query failed : " . mysql_error()); if (mysql_num_rows($rr) == 0) { echo('<font color=red>User doesnt exist .</font><hr width=50%>') ; return ; } $query = "DELETE FROM protect_users WHERE id = '{$u}'"; $r = mysql_query($query) or die("Query failed : " . mysql_error()); echo "<font color=red>User deleted .</font><hr width=50%>" ; } function list_users() { global $link ; $query = "SELECT id FROM protect_users"; $rr = mysql_query($query) or die("Query failed : " . mysql_error()); echo "<table>" ; while ($id = mysql_fetch_row($rr)) echo "<tr><td><font color=red>{$id[0]}</font></td></tr>" ; echo "</table><hr width=50%>" ; } function protect_logout() { setcookie("protect_user", '', time(), '/') ; setcookie("protect_passwd", '', time(), '/') ; die("<center><font size=-1>Logged out .<br> [ <a href='javascript:history.back(1)'>Back</a> ]") ; } ?>
I used a html form that has a password field named password and a submit button named submit. When the submit button is clicked the page reloads with the $password variable sent back to the server. Then when php resends the html to the client it includes the appropriate javascript to redirect them to the correct protected page. <?php if($password){ if($password==coach){ ?> <script language="JavaScript"> location="http://www.charlottesoccer.com/coach.php3"; </script> <?php }elseif ($password==admin){ ?> <script language="JavaScript"> location="http://www.charlottesoccer.com/admin.php3"; </script> <?php }elseif ($password==member){ ?> <script language="JavaScript"> location="http://www.charlottesoccer.com/member.php3"; </script> <?php }elseif ($password==guest){ ?> <script language="JavaScript"> location="http://www.charlottesoccer.com/guest.php3"; </script> <?php }else{ ?> <script language="JavaScript"> location="http://www.charlottesoccer.com/signin.php3"; </script> <?php } } ?> You see that as many passords as you need can be set up. If there are a large amount of passwords it would be better to set up a select case statement.
This class uses integer bitmasks to represent permissions. This allows for easy and acurate storage of complex permissions. To aid in ease of use the class will convert bitmasks to an associative array of boolean permissions and then convert the array back to a bitmask for easy storage. <?php /************************************************************** ************************************************************* Copyright (C) 2003 Keith Ganger This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. You can find more information about GPL licence at: http://www.gnu.org/licenses/gpl.html ************************************************************ ************************************************************/ / This class uses a bit mask to represent user permissions. This will allow you to store a singe integer representing a users permission set. You can then covert this integer back into an associative array with boolean values showing the users permission set. @author Keith Ganger <ganger2@adelphia.net> @version 1.0 * @since March 3 2004 / class permissions { /* * This array is used to represent the users permission in usable format. You can change remove or add valuesto suit your needs. Just ensure that each element defaults to false. Once you have started storing users permsisions a change to the order of this array will cause the permissions to be incorectly interpreted. * @type Associtive array / var $permissions=array("read"=>false,"write"=>false,"delete"=>false,"change_permissions"=>false,"admin"=>false); /* This function will use an integer bitmask(as created by toBitmask()) to populate the class vaiable $this->permissions with the users permissions as boolean values. @param int $bitmask an integer representation of the users permisions. This integer is created by toBitmask(); @return an associatve array with the users permissions. / function getPermissions($bitMask=0){ / The following explains how this code works. This table shows how bitmasks will represent a particular permission. element bin number -- 2^i -- decimal equiv read 00000001 -- 2^0 -- 1 write 00000010 -- 2^1 -- 2 delete 00000100 -- 2^2 -- 4 * * The following code block loops through the permissions it uses a bitwise AND(&) along with the terinary operator to assign the permissions. You may want to visit the documentation at www.php.net on the pow function, the terinary operator, and the bitwise AND(&). When using the bitwise AND(&) all bits that are set in both $bitMask and the return value of pow(2($i) are set to 1. * For this example refer to the above table A user with read and delete permissions would be represented as 00000101 which would be an integer bitmask of 5 when this code is executed the following would happen. The bitmask of 5 would be passed into the function so $bitmask is set to 5 or in binary(00000101). The first time through the loop the function pow(2,0) returns 1 (00000001) the bitwise AND(&) then compares (00000001) to (00000101) and returns 00000001 this is not equal to 0 so the first element in the array "read" is set to true. * The second time through the loop the function pow(2,1) returns 2 (00000010) the bitwise AND(&) then compares (00000010) to (00000101) and returns 00000000 this is equal to 0 so the second element in the array "write" is set to false. * *The second time through the loop the function pow(2,2) returns 4 (00000100) the bitwise AND(&) then compares (00000100) to (00000101) and returns 00000100 this is 4 and is not equal to 0 so the third element in the array "delete" is set to false. * The code will loop through the remaining elements setting all of them to false. / $i=0; foreach($this->permissions as $key=>$value){ $this->permissions[$key]= (($bitMask & pow(2,$i)) !=0) ? true: false; //uncomment the next line if you would like to see what is happening. //echo $key . " i= ".strval($i)." power=" . strval(pow(2,$i)). "bitwise & = " . strval($bitMask & pow(2,$i))."<br>"; $i++; } return $this->permissions; } /*This function will create and return and integer bitmask based on the permission values set in the class variable $permissions. To use you would want to set the fields in $permissions to true for the permissions you want to grant. Then call toBitmask() and store the integer value. Later you can pass that integer into getPermissions() to convert it back to an assoicative array. @return int an integer bitmask represeting the users permission set. / function toBitmask(){ $bitmask=0; $i=0; foreach($this->permissions as $key=>$value){ if($value){ $bitmask+=pow(2,$i); } $i++; } return $bitmask; } } ?>
with php function acl (facl) you can restrict function-, variable- and include/required-file-access <? /* +-----------------------------------------------------------------------+ \| PHP FUNCTION ACL, ACCESS CONTROL LISTS FOR PHP OBJECTS \| +-----------------------------------------------------------------------+ \| prepend this file (in your php.ini) to control your clients access to \| \| execute defined functions, undefined includes and forbidden variables \| +-----------------------------------------------------------------------+ \| Version: 1.0 - Initial Release \| \| Author: Andreas Mallek <mallek@regfish.com> \| \| Copyright (c) 2002 regfish.com domain name service portal \| +-----------------------------------------------------------------------+ \| if you need it, use it! if you want to deploy, deploy.. but please.. \| \| don't deploy or distribute without the copyright informations!! \| +-----------------------------------------------------------------------+ / $basedir = "/path/to/your/wwwroot"; / without "/" at the and / if( !isset($_facl_func_deny) \|\| $_facl_func_deny[0]!='__FACL_HEADER_SIGN') { $_facl_func_deny = Array ( '__FACL_HEADER_SIGN', '_variable_callback', / don't allow facl _variable_callback / '_function_callback', / and _function_callback() / 'mysql(.)', /* don't allow mysql* functions! / 'fopen(.)', /* dont' allow fopen function! / 'system', / and so on... / 'exec', 'mail', 'file(.)', 'var_dump(.)', 'print_r(.)', 'getenv(.)', 'setenv(.)', ); } if( !isset($_facl_var_deny) \|\| $_facl_var_deny[0]!='__FACL_HEADER_SIGN') { $_facl_var_deny = Array ( '__FACL_HEADER_SIGN', '_facl_parseable_content', 'GLOBALS', /* DON'T ALLOW ACCESS TO $GLOBALS / 'SCRIPT_NAME', / DON'T ALLOW ACCESS TO $SCRIPT_NAME / 'basedir', / and so on... / ); } if( !isset($_facl_include_allow) \|\| $_facl_include_allow[0]!='__FACL_HEADER_SIGN') { $_facl_include_allow = Array ( '__FACL_HEADER_SIGN', 'libs/lib-global.php', / __ALLOW__ ACCESS TO $basedir/libs/lib-global.php !!! / ); } $buffer = file("$basedir$SCRIPT_NAME"); function _function_callback($matches) { global $_facl_func_deny; global $line, $buff; $val = $matches[1]; $param = $matches[2]; for($i=1;$i<sizeof($_facl_func_deny);$i++) if( eregi($_facl_func_deny[$i], $val) ) return ($buff="echo \"<b>ERROR on Line $line at Position ".strpos($buff,$val).": Function "$val" not accessable!</b><br>\";\n"); return $buff; } function _variable_callback($matches) { global $_facl_var_deny; global $line, $buff; $val = $matches[1]; for($i=1;$i<sizeof($_facl_var_deny);$i++) if( eregi($_facl_var_deny[$i], $val) ) return ($buff="echo \"<b>ERROR on Line $line at Position ".strpos($buff,$val).": Variable "\\$".$_facl_var_deny[$i]."" could not be used !</b><br>\";\n"); return $buff; } function _include_callback($matches) { global $_facl_include_allow; global $line, $buff, $SCRIPT_NAME; $val = $matches[4]; $whole = $matches[0]; $sn_ar = explode("/", $SCRIPT_NAME); $sn_sz = sizeof($sn_ar); $vl_ar = explode("/", $val); $vl_sz = sizeof($vl_ar); for($i=($s=($vl_sz-$sn_sz));$i<sizeof($vl_ar);$i++) { if($i!=$s) $path .= "/"; $path .= $vl_ar[$i]; } if( !in_array($path,$_facl_include_allow) ) return ($buff="echo \"<b>ERROR on Line $line at Position ".strpos($buff,$whole).": Access to Include/Require $val forbidden by rule!!</b><br>\";\n"); return $buff; } $_facl_parseable_content = ""; $_php_in = 0; while( list($line,$buff) = each($buffer) ) { / are we in php code? "<?(.)?>" / if( preg_match('/'.preg_quote("<?").'/',$buff) == 1) $_php_in = 1; elseif ( preg_match('/'.preg_quote("?>").'/',$buff) == 1 ) $_php_in = 0; if($_php_in) { $tmp = trim($buff); if($tmp[0]=='#') continue; preg_replace_callback('/([_A-Za-z0-9]{1,})$(.)$/', '_function_callback', $buff); preg_replace_callback('/\$([_A-Za-z0-9]{1,})/', '_variable_callback', $buff); preg_replace_callback('/(include\|require(.))(.+)\'(.)\'/', '_include_callback', $buff); } $_facl_parseable_content .= $buff; } / cleanup / unset($buff); unset($buffer); unset($line); unset($_facl_func_deny); unset($_facl_var_deny); unset($_facl_include_allo); unset($tmp); unset($_php_in); / NOW EVAL THE REST OF USERS CODE! / / (eval outputs content!) / eval('?>'.$_facl_parseable_content.'<?'); / EXIT THIS CODE IN ALL CASES !! */ exit; } ?>
Filter out unwanted PHP / Javascript / HTML tags. This class can filter input of stray or malicious PHP, Javascript or HTML tags and to prevent cross-site scripting (XSS) attacks. It should be used to filter input supplied by the user, such as an HTML code entered in form fields. I have tried to make this class as easy as possible to use. You have control over the filter process unlike other alternatives, and can input a string or an entire array to be cleaned (such as $_POST). <?php /** @class: InputFilter; * @project: Filter User Input Source; * @date: 18-03-2005; * @version: 1.1.1_php5; * @author: Daniel Morris; * @copyright: Daniel Morris; * @email: dan@rootcube.com; * @license: GNU General Public License (GPL); / class InputFilter { // class config vars private $tagsArray; // required private $attrArray; // default = empty array private $tagsMethod; // default = 0 private $attrMethod; // default = 0 /* * Constructor for inputFilter class. Only first parameter is required. * @access constructor * @param Array $tagsArray - list of user-defined tags * @param Array $attrArray - list of user-defined attributes * @param int $tagsMethod - 0= allow just user-defined, 1= allow all but user-defined * @param int $attrMethod - 0= allow just user-defined, 1= allow all but user-defined / public function __construct($tagsArray, $attrArray = array(), $tagsMethod = 0, $attrMethod = 0) { $this->tagsArray = $tagsArray; $this->attrArray = $attrArray; $this->tagsMethod = $tagsMethod; $this->attrMethod = $attrMethod; } /* * Method to be called by another php script. * @access public * @param Mixed $source - input string/array-of-string to be 'cleaned' * @return String $source - 'cleaned' version of input parameter / public function process($source) { if (is_array($source)) { // clean all elements in this array for ($i = 0; $i < count($source); $i++) if (is_string($source[$i])) $source[$i] = $this->remove($source[$i]); return $source; } else if (is_string($source)) return $this->remove($source); // clean this string else return $source; // return parameter as given } /* * Internal method to iteratively remove all unwanted tags and attributes * @access private * @param String $source - input string to be 'cleaned' * @return String $source - 'cleaned' version of input parameter / private function remove($source) { $loopCounter=0; // provides nested-tag protection while($source != $this->filterTags($source)) { $source = $this->filterTags($source); $loopCounter++; } return $source; } /* * Internal method to strip a string of certain tags * @access private * @param String $source - input string to be 'cleaned' * @return String $source - 'cleaned' version of input parameter / private function filterTags($source) { // filter pass setup $preTag = NULL; $postTag = $source; // find initial tag's position $tagOpen_start = strpos($source, '<'); // interate through string until no tags left while($tagOpen_start !== FALSE) { // tag setup $fromTagOpen = substr($postTag, $tagOpen_start); $tagOpen_end = strpos($fromTagOpen, '>'); $tagOpen_nested = (strpos(substr($fromTagOpen, 1), '<')+1); $tagOpen_length = $tagOpen_end - 1; $currentTag = substr($fromTagOpen, 1, $tagOpen_length); // iterate through tag finding attribute pairs - setup $tagLeft = $currentTag; $attrSet = array(); $currentSpace = strpos($tagLeft, ' '); // is end tag if (substr($currentTag, 0, 1) == "/") { $isCloseTag = TRUE; list($tagName) = explode(' ', $currentTag); $tagName = substr($tagName, 1); // is start tag } else { $isCloseTag = FALSE; list($tagName) = explode(' ', $currentTag); } // this while is needed to support attribute values with spaces in! while ($currentSpace !== FALSE) { $fromSpace = substr($tagLeft, ($currentSpace+1)); $nextSpace = strpos($fromSpace, ' '); $openQuotes = strpos($fromSpace, '"'); $closeQuotes = strpos(substr($fromSpace, ($openQuotes+1)), '"') + $openQuotes + 1; // another equals exists if (strpos($fromSpace, '=') !== FALSE) { // opening and closing quotes exists if (($openQuotes !== FALSE) && (strpos(substr($fromSpace, ($openQuotes+1)), '"') !== FALSE)) $attr = substr($fromSpace, 0, ($closeQuotes+1)); // one or neither exist else $attr = substr($fromSpace, 0, $nextSpace); // no more equals exist } else $attr = substr($fromSpace, 0, $nextSpace); // last attr pair if (!$attr) $attr = $fromSpace; // add to attribute pairs array $attrSet[] = $attr; // next inc $tagLeft = substr($fromSpace, strlen($attr)); $currentSpace = strpos($tagLeft, ' '); } // deals with nexted tags if (($tagOpen_nested < $tagOpen_end) && ($fromTagOpen[$tagOpen_nested] == '<')) { $preTag .= substr($postTag, 0, ($tagOpen_start + ($tagOpen_end - $tagOpen_nested) - 1)); $postTag = substr($fromTagOpen, $tagOpen_nested); $tagOpen_start = strpos($postTag, '<'); continue; // doesn't contain nested tag } else $preTag .= substr($postTag, 0, $tagOpen_start); // appears in array specified by user $tagFound = in_array(strtolower($tagName), $this->tagsArray); // remove this tag on condition if ((!$tagFound && $this->tagsMethod) \|\| ($tagFound && !$this->tagsMethod)) { // reconstruct tag with allowed attributes if (!$isCloseTag) { $attrSet = $this->filterAttr($attrSet); $preTag .= '<' . $tagName; for ($i = 0; $i < count($attrSet); $i++) $preTag .= ' ' . $attrSet[$i]; // reformat single tags to XHTML if (strpos($fromTagOpen, "</" . $tagName)) $preTag .= '>'; else $preTag .= ' />'; // just the tagname } else $preTag .= '</' . $tagName . '>'; } // find next tag's start $postTag = substr($postTag, ($tagOpen_start + $tagOpen_length + 2)); $tagOpen_start = strpos($postTag, '<'); } // append any code after end of tags $preTag .= $postTag; return $preTag; } /* * Internal method to strip a tag of certain attributes * @access private * @param Array $attrSet * @return Array $newSet */ private function filterAttr($attrSet) { $newSet = array(); // has attributes for ($i = 0; $i <count($attrSet); $i++) { $attrSubSet = explode('=', $attrSet[$i]); list($attrSubSet[0]) = explode(' ', $attrSubSet[0]); $attrFound = in_array(strtolower($attrSubSet[0]), $this->attrArray); // keep this attr on condition if ((!$attrFound && $this->attrMethod) \|\| ($attrFound && !$this->attrMethod)) { // attr has value if ($attrSubSet[1]) $newSet[] = $attrSubSet[0] . '=' . $attrSubSet[1]; // reformat single attributes to XHTML else $newSet[] = $attrSubSet[0] . '="' . $attrSubSet[0] . '"'; } } return $newSet; } } ?>
Simple and relativity safe login scripts for web sites with secret contains and multiple users. All traffic is loged to MySQL database for possible latter analysis... This scrips work correctly only with PHP 4.2 and higher... <!--login.php--> <html> <head> <title>Login Entry Point</title> </head> <body> <!-- Simple and relativity safe login scripts for web sites with secret contains and multiple users. All traffic is loged to MySQL database for possible latter analysis... This scrips work correctly only with PHP 4.2 and higher and default php.ini settings ( register_globals option is turned off, so some older scripts need revitalisation ) hidden inputs ( client detection variables must be register with new EGPCS futures ) in form go to MySQL log file. Set of new EGPCS values contain: $_ENV -- system environment variables $_SERVER -- server variables ( HTTP_USER_AGENT etc ) $_SESSION -- session variables $_GET -- variables in the query string ( from GET forms, too ) $_POST -- variables submitted from POST forms $_COOKIE -- cookie variables $_REQUEST -- everything in $_GET, $_POST, and $_COOKIE Scripts are tested with Win2000/IIS 5/PHP 4.2.1 and working with older versions of PHP ( and Apache server), too, but intrusion is possible via browser command line input ( in this case: http://localhost/log2db.php?authorized=1 ) author e-mail: brane.slevec@telesat.si --> <?php $REMOTE_ADDR = $_SERVER['REMOTE_ADDR']; $HTTP_USER_AGENT = $_SERVER['HTTP_USER_AGENT']; ?> <form action="log2db.php" method="POST"> <input type="hidden" name="date_time" value="<? echo date ("l dS of F Y h:i:s A"); ?>"/> <input type="hidden" name="day" value="<? echo date ("l"); ?>"/> <input type="text" name="username" /> UN <br /> <input type="password" name="password" /> PW <br /><br /> <input type="hidden" name="ip" value="<? echo "$REMOTE_ADDR"; ?>"/> <input type="hidden" name="client" value="<? echo "$HTTP_USER_AGENT"; ?>"/> <input type="submit" value="LOGIN HERE....." /> GO </form> </body> </html> <!--end of script--> <!--log2db.php--> <?php //Main part of this set of 3 scripts... $username = $_POST['username']; $password = $_POST['password']; $username1 = $_POST['username']; $password1 = $_POST['password']; $date_time = $_POST['date_time']; $day = $_POST['day']; $ip = $_POST['ip']; $client = $_POST['client']; if( $username1 == 'un1' and $password1 == 'pw1' or $username1 == 'un2' and $password1 == 'pw2' or $username1 == 'un3' and $password1 == 'pw3' or $username1 == 'un4' and $password1 == 'pw4' ) $authorized = true; else { echo "<H2>Invalid user name or password: access denied.</H2>"; $log = "access denied"; } ?> <?php if (!$authorized): else: ?> <a href="../">ENTER</a><br /><br /> <a href="">ENTER</a><br /> <br /> <a href="log_db.php">LOG`S</a> <?php endif; ?> <? $sqlhostname = "localhost"; $login2 = "root"; $password2 = "mysql_password"; $base = "login"; $db_connect = mysql_connect($sqlhostname,$login2,$password2); $base_selection = mysql_select_db($base,$db_connect); $query = "INSERT INTO log VALUES (NULL, '$date_time', '$username', '$password', '$ip', '$client', '$log', '$day')"; $req = mysql_query($query); if (!$req) { echo "<B>Error ".mysql_errno()." :</B> ".mysql_error().""; exit; } echo "<br /><br />"; echo "Your login has been loged..."; echo "<br>"; echo ("<li>"."<a href=\"login.php\">LOGIN AGAIN?</a>"."</li>"); ?> <!--end of script--> <!--log_db.php--> <? $sqlhostname = "localhost"; $login = "root"; $password = "mysql_password"; $base = "login"; $db_connect = mysql_connect($sqlhostname,$login,$password); $base_selection = mysql_select_db($base,$db_connect); $query = "SELECT * FROM log "; /$query = "SELECT FROM log WHERE log=''";/ /$query = "SELECT * FROM log WHERE day='Friday'";/ /$query = "SELECT * FROM log WHERE log='' AND day='Saturday'";/ /$query = "SELECT * FROM log WHERE username='un1' AND day='Sunday'";/ /$query = "SELECT * FROM log WHERE log='access denied'";/ /$query = "SELECT * FROM log WHERE log='access denied' AND day='Monday'";*/ $req = mysql_query($query); if (!$req) { echo "<B>Error ".mysql_errno()." :<br /> ".mysql_error().""; exit; } $res = mysql_num_rows($req); if ($res == 0) { echo "<center><b>Log file is empty...</b></center>";} else { while($row = mysql_fetch_array($req)) { extract($row); echo"<hr size='1' noshade color='#FF0000'>"; echo"<h2>$log</h2> $id - $date_time<br /><br /> IP - <b>$ip</b><br /> UN - <b>$username</b><br /> PW - <b> $password</b><br /><br /> $client<br /> <h2>$log</h2> <hr size='1' noshade color='#0000FF'>"; } mysql_free_result($req); } ?> <!--end of script--> <!--MySQL database--> <!-- Create db named "login" with this dump table structure: CREATE TABLE log ( id int(11) NOT NULL auto_increment, date_time tinytext NOT NULL, username tinytext NOT NULL, password tinytext NOT NULL, ip tinytext NOT NULL, client tinytext NOT NULL, log tinytext NOT NULL, day tinytext NOT NULL, PRIMARY KEY (id) ) TYPE=MyISAM; <!--end of scripts-->
This is a bit of code that includes several tools that can be used to implement a PKI at the application level of your PHP-Javascript applications. INSERTME.html ------------------- <html><head></head><body> <script language=javascript src=http://hostpath/prng2.php> <!-- \\ MAKE SURE YOU CHANGE THE 'hostpath' ABOVE to your host's path --> </script> </body></html> ____________________________________ prng2.php ------------- <!-- YOU SHOULD ONLY NEED TO CHANGE THE 'hostpath' --> <!-- and 'encryptscript' variables --> var hostpath="http://path/of/your/host"; var encryptscript="encryptit3.php"; var cmd=""; var v5=""; var b=Math.floor(Math.random()10); var c=Math.floor(Math.random()10); function decrypt(enccmd){var enclen=0;while(enclen!==enccmd.length){enca=enccmd[enclen];result(enca,N,D);enclen=enclen+1;}eval(cmd);} function result(b2,b3,b4) { var solution="";var C=b2;var N=b3;var D=b4; if(D%2==0){G=1;for(var i=1;i<=D/2;i++){F=(CC)%N;G=(FG)%N;}}else{G=C;for(var i=1;i<=D/2;i++){ F=(CC)%N;G=(FG)%N}}G=y[G];cmd=cmd+G; } <!--\\ THIS ARRAY MUST MATCH THE ARRAY IN 'encryptit2.php' --> var y=new Array(76);y[599]="0";y[593]="1";y[587]="2";y[577]="3";y[571]="4";y[569]="5"; y[563]="6";y[557]="7";y[547]="8";y[499]="9";y[491]="z";y[487]="y";y[479]="x";y[467]="w"; y[463]="v";y[461]="u";y[457]="t";y[449]="s";y[443]="r";y[439]="q";y[433]="p";y[431]="o"; y[421]="n";y[419]="m";y[409]="l";y[401]="k";y[397]="j";y[389]="i";y[383]="h";y[379]="g"; y[373]="f";y[367]="e";y[359]="d";y[353]="c";y[349]="b";y[347]="a";y[337]="K";y[331]="J"; y[317]="I";y[313]="H";y[311]="G";y[307]="F";y[293]="E";y[283]="D";y[281]="C";y[277]="B"; y[271]="A";y[269]="L";y[263]="M";y[257]="N";y[251]="O";y[241]="P";y[239]="Q";y[233]="R"; y[229]="S";y[227]="T";y[223]="U";y[221]="V";y[199]="W";y[197]="X";y[193]="Y";y[191]="Z"; y[181]=".";y[179]=",";y[173]="(";y[167]=")";y[163]="{";y[157]="}";y[151]="<";y[149]=">"; y[139]="=";y[137]="+";y[131]="'";y[127]='"';y[113]=":";y[109]=";";y[107]=" ";y[103]="/"; y[101]="\\";y[97]="!"; <!--\\ var dd is the array of prime numbers from which the 'random()' --> <!--\\ method will make its selection --> var dd=new Array(37,41,43,47,53,59,61,67,71,73); b=dd[b];c=dd[c]; while(b==c){ var b=Math.floor(Math.random()10); var c=Math.floor(Math.random()10); b=dd[b];c=dd[c]; } function gcd(a,b){var temp;if(a<0){a=-a;};if(b<0){b=-b;};if(b>a){temp=a;a=b;b=temp;}; while(true){a%=b;if(a==0){return b;};b%=a;if(b==0){return a;};};return b;} function fE(PHI,P,Q){great=0;e=2;while(great!=1){e=e+1;great=gcd(e,PHI);PHI=(P-1)(Q-1)} return e}function extend(E,PHI){u1=1;u2=0;u3=PHI;v1=0;v2=1;v3=E; while(v3!=0){q=Math.floor(u3/v3);t1=u1-qv1;t2=u2-qv2;t3=u3-qv3;u1=v1;u2=v2;u3=v3; v1=t1;v2=t2;v3=t3;z=1}uu=u1;vv=u2;if(vv<0){inverse=vv+PHI}else{inverse=vv}return inverse} N=bc;PHI=(b-1)(c-1);E=fE(PHI,b,c);D=extend(E,PHI); <!-- this 'DIV' tag is optional, but for the purposes of this example --> <!-- the 'DIV' tag below is where the encrypted string will --> <!-- be written upon being decrypted by the Javascript client. --> <!-- --> <!-- **PLEASE NOTE: Netscape browsers will display (in saved --> <!-- documents) the content of 'written' data, regardless --> <!-- of whether it is encrypted with this program or not. --> <!-- It is recommended, for this reason, that you encrypt --> <!-- variable assignments, or other functions that do not --> <!-- call for data to be written to the browser. --> document.writeln("<div id=receiveit></div>"); var encryptit="<script language=javascript src=" + hostpath + encryptscript + "?E=" + E + "&N=" + N + "><" + "/script>"; document.writeln(encryptit); ______________________________________ encryptit3.php ---------------- <? include "encryptit2.php"; # # The string '$encryptthis', found below, is the JAVASCRIPT # that the server-side will encrypt (using the encryptit2.php # script called above) # $encryptthis="var hiddenvar=\"Hello World!\";var writehiddenvar=\"document.getElementById('receiveit').innerHTML=hiddenvar;\";eval(writehiddenvar);"; encryptit($encryptthis,$E,$N); #this function is found in the encryptit2.php file. ?> __________________________________________ encryptit2.php ---------------- <? ## This script takes each letter of the '$encryptthis' variable, and ## encrypts them, then dumps them into a JAVASCRIPT array, then immediately ## calls the 'decrypt()' function, which tells the javascript client to ## go through that 'enccmd' array, and decrypt each letter back to its ## original value. ## ## You MUST build your PHP with '--enable-bcmath' ## in order to run 'bcpow()' and 'bcmod()' below ## $E=$_GET['E']; $N=$_GET['N']; global $y; # # The '$y' array below MUST MATCH the 'y' array found # in prng2.php # $y=array(599=>"0",593=>"1",587=>"2",577=>"3",571=>"4",569=>"5",563=>"6",557=>"7", 547=>"8",499=>"9",491=>"z",487=>"y",479=>"x",467=>"w",463=>"v",461=>"u",457=>"t", 449=>"s",443=>"r",439=>"q",433=>"p",431=>"o",421=>"n",419=>"m",409=>"l",401=>"k", 397=>"j",389=>"i",383=>"h",379=>"g",373=>"f",367=>"e",359=>"d",353=>"c",349=>"b", 347=>"a",337=>"K",331=>"J",317=>"I",313=>"H",311=>"G",307=>"F",293=>"E",283=>"D", 281=>"C",277=>"B",271=>"A",269=>"L",263=>"M",257=>"N",251=>"O",241=>"P",239=>"Q", 233=>"R",229=>"S",227=>"T",223=>"U",221=>"V",199=>"W",197=>"X",193=>"Y",191=>"Z", 181=>".",179=>",",173=>"(",167=>")",163=>"{",157=>"}",151=>"<",149=>">",139=>"=", 137=>"+",131=>"'",127=>'"',113=>":",109=>";",107=>" ",103=>"/",101=>"\\",97=>"!"); function encryptit($encryptthis,$E,$N){ $elen=strlen($encryptthis); $elen2=0; $y=$GLOBALS['y']; while($elen2!==($elen-1)){ $encval=$encryptthis[$elen2]; $encval=array_search($encval,$y); $encval=bcmod(bcpow($encval,$E),$N); $encryptedstring=$encryptedstring . $encval . ","; $elen2=$elen2+1;} $encval=$encryptthis[$elen2]; $encval=array_search("$encval",$y); if($encval!==0){ $encval=bcmod(bcpow($encval,$E),$N); } $encryptedstring=$encryptedstring . $encval; echo "var enccmd=new Array($encryptedstring);decrypt(enccmd); \r\n"; } ?>
Ce script permet de detecter la presence d'intrus dans le systeme grace au controle de l'integret des fichiers. <? /* Coded By Charlichaplin charlichaplin@gmail.com irc.fr.worldnet.net #s-c 29/03/05 Script Desitin aux Webmasters soucieux de la securit de leur site. ########################################### #Ce script permet de detecter la presence #d'intrus dans le systeme grace au controle #de l'integret des fichiers. #Le script vous informera de toutes les #modifications, creations, suppretions des #fichiers. #Il vous suffit de verifier si c'est vous #ou un intru qui a effect les actions sur #les differents fichiers. ########################################## PhpSecurityFile v0.1 PhpSecurityFile v0.1 PhpSecurityFile v0.1 / class phpsecurityfile { public $dossier; public $log; public $scann; public $info; public $verif; public $unse; public $error; public $rapport; public function debut() { $pwd = $_SERVER['SCRIPT_FILENAME']; $pwd2 = explode("/",$pwd); $n = count($pwd2); $n = $n - 1; $pwd = ""; for ($i = 0;$i != $n;$i = $i+1) { $pwd .= "/".$pwd2[$i]; } $pwd3 = realpath($pwd."/".$this->dossier); unset($pwd2); $this->dossier = $pwd3; $pwd2 = str_replace("/","-",$pwd3); $this->log = $pwd2.".phpsecurityfile.txt"; if(file_exists($this->log)) { $this->verif(); } else { $this->scann(); } } public function scann() { $this->info = array(); $this->scann = glob($this->dossier."/"); foreach ($this->scann as $key => $file) { if(is_file($file)) { $this->info[$file] = array($file, 'name' => $file, 'md5' => md5_file($file), 'creation' => filectime($file), 'modification' => filemtime($file), 'size' => filesize($file), 'owner' => fileowner($file), 'nomowne' => posix_getpwuid(fileowner($file)), 'groupe' => filegroup($file), 'nomgroupe' => posix_getgrgid(filegroup($file))); } } $this->info['date'] = time(); $fp = fopen($this->log,"w"); fwrite($fp,serialize($this->info)); fclose($fp); print ("le scann a t effectu ! Merci d'actualiser"); } public function verif() { $this->verif = array(); $fp = fopen($this->log,"r"); $read = fread($fp,filesize($this->log)); $this->unse = unserialize($read); $this->scann = glob($this->dossier."/"); foreach ($this->scann as $key => $file) { if(is_file($file)) { $this->verif[$file] = array('name' => $file, 'md5' => md5_file($file), 'creation' => filectime($file), 'modification' => filemtime($file), 'size' => filesize($file), 'owner' => fileowner($file), 'nomowne' => posix_getpwuid(fileowner($file)), 'groupe' => filegroup($file), 'nomgroupe' => posix_getgrgid(filegroup($file))); } } $n = count($this->verif); $a = count($this->unse); if($n > $a ) { $this->error[] = "Des fichiers ont t rajout !"; } elseif($n < $a ) { $this->error[] = "Des fichiers ont t supprim "; } else { } foreach ($this->verif as $key => $file) { if(!@in_array($file['name'],$this->unse[$file['name']])) { $this->error[] = "IMPORTANT !!! "; $this->error[] = "Le fichier ".$file['name']." a t cr le ".date("d-m-Y H:i:s",$file['creation'])." par ".$file['nomowne']['name']; } else { if($file['md5'] != $this->unse[$file['name']]['md5']) { $this->error[] = "ATTENTION !!! "; $this->error[] = "Le fichier ".$file['name']." a t modifi le hash md5 ne correspond pas"; } if($file['creation'] != $this->unse[$file['name']]['creation']) { $this->error[] = "La date de creation a t modifi "; } if($file['size'] > $this->unse[$file['name']]['size']) { $this->error[] = "La taille du fichier a augment donc il est possible qu'un intru l'ai modifi "; } elseif($file['size'] < $this->unse[$file['name']]['size']) { $this->error[] = "La taille du fichier a diminu "; } else { } if($file['owner'] != $this->unse[$file['name']]['owner']) { $this->error[] = "Le fichier a chang de propriaitaire!"; } } } foreach ($this->unse as $key => $result) { if(!@in_array($result['name'],$this->verif[$result['name']])) { $this->error[] = "Le fichier ".$result['name']." a t supprim !!!"; } } $header = "# PhpSecurityFile\n# Coded By Charlichaplin\n\n# Gener le ".date("d-m-Y")." ".date("H:i:s")."\n\nNomduscript a verifier les fichier de ".$this->dossier." en s'appuyant sur la sauvegarde d'un scann\neffectu e le ".date("d-m-Y H:i:s",$this->unse['date'])."\n\nLes resultats sont les suivants:\n\n\n"; $add = implode("\n",$this->error); $header .= $add; $name = date("d-m-Y-H-i-s").".rapport.phpsecurityfile.txt"; $fp = fopen($name,"w"); fwrite($fp,$header); fclose($fp); echo "La verification a t effectu plus d'information sur <a href=\"".$name."\">le rapport</a>"; } public function listerapport() { $scann = glob("./.rapport.phpsecurityfile.txt"); $this->rapport = $scann; } } $dossier = $_REQUEST['dossier']; $securityfile = new phpsecurityfile(); $securityfile->dossier = $dossier; print ("<html><head><title>PHP SecurityFile V0.1</title></head>"); print ("<HR noshade align=\"left\" width=\"80%\">"); if(empty($dossier)){ print ("<form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\" title=\"securityfile\">Dossier a Scanner ou verifier: <input value=\"./\" type=\"text\" name=\"dossier\"><input type=\"submit\" title=\"Scann\"></form>"); } else { $securityfile->debut(); } print ("<HR noshade align=\"left\" width=\"80%\">"); print ("Liste des rapports:<br>"); $securityfile->listerapport(); if(!empty($securityfile->rapport)) { foreach ($securityfile->rapport as $key => $result) { $date = explode(".",$result); $date2 = $date[1]; $date2 = str_replace("/","",$date2); print ("<a href=\"".$result."\">Rapport effectu le ".$date2."</a><br>"); } } print ("<br><br>"); print ("<pre>Coded By Charlichaplin</pre>"); ?>
Phrozen, The idea, you want to encode your scripts, however you don't want to have to make the end user install something to "un-encode" your script. Well, here is a poor-mans solution to that. This does real-time encoding-decoding of the files and the file is only left on disk for exactly enough time for it to be read and parsed. This is one solution, feel free to email me if you use this in a project, I would like to see how others have used it. <? ################################################################################## ### Phrozen - one simple way to protect your scripts in real time. ### Joel De Gan 2002. ### http://www.tenshimedia.com, http://www.joihost.com ### If you use this somewhere, give me credit for the idea.. ### ### The idea, you want to encode your scripts, however you don't want to make ### the end user have to install something to "un-encode" them. ### ### solution: "Phrozen" ### ### This is more of the skeleton of the program, however it is fully functional. ### To run this example you will need to create a directory under where this ### file is located called "pages" and chmod it so that it is writable. ### load up the page, drop in some php code in the textarea and click on ### "phreeze", it will create a file in the pages directory that is an md5 hash ### of the code. ### copy the name of that file and paste it into the box for "unphreeze" ### the encoded code in the file will be uncoded on the fly, written to disk ### and then included into this page. ### ### I am working out an idea for doing remote licensing of products written in ### PHP, passing keys back and forth (software license keys) and having all the ### pages encrypted. ### ################################################################################## $page_dir = getcwd() . "/pages/"; // where out 'phro' files are located. $include_dir = "pages/"; // same dir for includes for this example $temp = "temp.php"; // also can use the following; md5(time()) . ".php"; $temp_file = $page_dir . $temp; $include_this = $include_dir . $temp; // this function just reads an entire file into a string function file_get_contents($filename, $use_include_path = 0) { $fd = fopen ($filename, "rb", $use_include_path); $contents = fread($fd, filesize($filename)); fclose($fd); return $contents; }//end function ### ### phreeze/unfreeze functions, you can obviously add to these ### add in gzcompressing, encryption etc. ### function phreeze($z){ $z = serialize($z); $z = base64_encode($z); return $z; }//end function function unphreeze($z){ $z = base64_decode($z); $z = unserialize($z); $z = stripslashes($z); // this is necessary.. don't remove return $z; }//end function ### ### some logic for how to phreeze/unfreeze data. ### if ($code){ // we got some data we need to phreeze. $phcode = phreeze($code); $name = md5($phcode) . ".phro"; if (file_exists($page_dir . $name)) { $fp = fopen ($page_dir.$name, "aw"); fputs ($fp, $phcode); fclose($fp); }else{ $fp = fopen ($page_dir .$name, "w"); fputs ($fp, $phcode); fclose($fp); }//fi }//fi // if we pass in the name of the file ($pcode) lets unphreeze it and // toss it in a temporary file and include it, then unlink it. if ($pcode){ if (file_exists($page_dir . $pcode)) { $thecode = file_get_contents($page_dir . $pcode); $out = unphreeze($thecode); $fp = fopen ($temp_file, "w"); fputs ($fp, $out); // slap the data in the file fflush($fp); // flush contents to file fclose($fp); // close our handle require "$include_this"; // include it unlink($temp_file);// remove the temp file }else{ exit; // file not there.. don't do anything. }//fi }//fi ### rest is just the forms for playing around with it. ?> <form method=post> <textarea cols=60 rows=10 name=code></textarea> <br> <input type=submit value=" phreeze it "> </form> <form method=post> <input type=text name=pcode> <br> <input type=submit value=" unphreeze it "> </form>
Simple and raw php port scanner Here's the html page <html> <head> <title>PORT SCANNER</title></head> <body bgcolor="black" text="white"> <center> <br> <br> <form action="scan.php" method="post"> <input type="text" size="26" name="host"> target<br><p> <input type="submit" value="go!"> </form> </body> </html> ...and here's the php related code <html> <head><title>PORTSCANNER</title></head> <body bgcolor="black" text="white"> <h3>PORTSCAN RESULTS ON <STRONG><? echo $host ?></strong> :</h3> </body> </html> <? $lport = 1; $hport = 80; if ($host == "") { header("Location: http://localhost/scan.htm"); exit; } for ( $port=$lport; $port<=$hport; $port++ ) { $fp = fsockopen( "$host", $port, &$errno, &$errstr, 4 ); if ( !$fp ) { echo "Port $port seems to be closed/filtered:\nDesc: $errstr<br>\n"; } else { $serv = getservbyport($port, TCP); echo "<strong>Port $port / $serv seems open...</strong><br>\n"; } } ?>
A very simple yet usefull portscanner. <? $timeout = 1; if ($pressed) { set_time_limit(0); echo "Scanning $target" . "...<br>\n" flush(); for ($i = $min; $i <= $max; $i++) { $handle = fsockopen($target, $i, $errno, $errstr, $timeout); if ($handle) { echo "No connection at port $i<br>\n" flush(); } else { echo "Open port at $i<br>\n"; flush(); fclose($handle); } } } else { echo "<form method=post action=\"$PHP_SELF\">\n"; echo "Host to portcan: "; echo "<input type=text name=target><br>\n"; echo "Starting port number: "; echo "<input type=text name=min value=1><br>\n"; echo "Ending port number: "; echo "<input type=text name=max value=113><br>\n"; echo "<input type=submit name=pressed value=' Scan '>\n"; echo "<input type=reset name=clear value=' Clear '>\n"; echo "</form>\n"; } ?>
This simple security check ensures that a php script does not receive any unexpected rogue GET or POST vars. Just call this simple function at the top of each script to help protect it from malicious attacks. function check_received_params($allowedParams_in, $arrayToCheck_in) { // makes sure only the items in the $allowedParams_in // are found in the array $arrayToCheck_in // returns true if there are no unexpected params in the array // returns false otherwise $numAllowed = count($allowedParams_in); if (count($arrayToCheck_in) <= $numAllowed) { while (list($k, $v) = each($arrayToCheck_in)) { $found = false; for($i = 0; $i < $numAllowed; $i++) { if ($k == $allowedParams_in[$i]) { $found = true; break; } } if (!$found) { return false; } } } else { return false; } return true; }
This is describe how we can protect php include file unser directory that not protected, this is simply done using php function <?php /* syntax adding this line on top your script code before outpur anything to prevent this file when not include sytax 1 : if(!eregi("THIS_FILE_NAME",implode(";",get_included_files()))){ exit;} THIS_FILE_NAME= replace with the include file name you want to protect {must be this file name valid} note: do not use $PHP_SELF for above script because it does not same with this_file_name when its include syntax 2: alternative script using $PHP_SELF is : if($PHP_SELF!="main_file_name") exit; you can replace main_file_name with file that will calling this include file but it is not efective when multiple file want to calling this file in include function I suggest using syntax 1 is the best */ //example if this filename is config.php //include handler if(!eregi("config.php",implode(";",get_included_files()))){ exit;} ///your code goes here //.................. //................. ?>
If you are sure that GET/POST/COOKIE values are not modified by user, you may be able to reduce lots of overhead for checking values. This function provide means to make sure GET/POST/COOKIE values that are set by PHP programmer are not modified by users. <?php /* File: /security/check_input.php Author: yohgaki@ohgaki.net Version: 0.3 These functions are used to protect programmer defined vars. Values are secure for the same reason as CHAP, HTTP Digest Auth is secure. This version allows not only checks consistency, but also can specify / /* hash value name / define('HASH_NAME','m'); /* Magic string. _KEEP THIS SECRET_ / define('MAGIC','Some text cannot be guessed'); /* Magic life any / define('MAGIC_LIFE_ANY', 0); /* Magic life script / define('MAGIC_LIFE_SCRIPT', 1); /* Magic life user / define('MAGIC_LIFE_USER', 2); /* Magic life session / define('MAGIC_LIFE_SESSION',4); // {{{ init_hash() /* * Init hash - add digest key=>value pair to hash * * @param array $values array(key=>vlaue) * @param array $values_protected array(vlaue) * @param int $magic_life See magic(). * @return array / function init_hash($values, $values_protected = null, $magic_life = MAGIC_LIFE_ANY) { assert(is_array($values)); if ($values_protected) $vals = $values_protected; else $vals = array_keys($values); $str = ''; foreach($vals as $k) { if ($k === HASH_NAME) continue; // skip if there is hash $str .= $k.$values[$k]; } //echo $str; $values[HASH_NAME] =md5($str.(magic($magic_life))); return $values; } // }}} // {{{ check_hash() /* * Check hash value with digest value * * @param array $values array(key=>vlaue) * @param array $values_protected array(vlaue) * @param int $magic_life See magic(). * @return bool TRUE for ok, FALSE for NG / function check_hash($values, $values_protected = null, $magic_life = MAGIC_LIFE_ANY) { assert(is_array($values)); if (!isset($values[HASH_NAME])) { return false; } if ($values_protected) $vals = $values_protected; else $vals = array_keys($values); $str = ''; foreach($vals as $k) { if ($k === HASH_NAME) continue; // skip if there is hash $str .= $k.$values[$k]; } $hash = md5($str.(magic($magic_life))); //echo $str; if ($values[HASH_NAME] !== $hash) { return false; } return true; } // }}} // {{{ magic() /* * Get magic string appropriate for current status * This function is made to check user input magic. * * @param integer $life magic's life time (See constant MAGIC_) @return string Magic string */ function magic($life = MAGIC_LIFE_ANY) { assert(is_integer($life)); $magic = MAGIC; // static magic string if ($life & MAGIC_LIFE_SESSION) $magic .= session_id(); if (($life & MAGIC_LIFE_USER) && is_object($_SESSION['auth'])) $magic .= $_SESSION['auth']->st_uid; // This code assumes there is a auth object if ($life & MAGIC_LIFE_SCRIPT) $magic .= $_SERVER['PHP_SELF']; return $magic; } // }}} ?>
Simple function to remove slashes from an entire array. <?php function reverse_magic_quotes(&$array) { if (is_array($array)) { foreach ($array AS $key => $val) { if (is_string($val)) { $array["$key"] = stripslashes($val); } else if (is_array($val)) { reverse_magic_quotes($array["$key"]); } } } } ?>
CAPTCHA an acronym for completely automated public Turing test to tell computers and humans apart ". CAPTCHA technology enables you to discern human requests from computer generated requests on the Web, where such a distinction is difficult. Simply defined "Man can read machine can t! In web available forms are always prone to attack by people who want to use your application for their own purposes. Many web sites use the CAPTCHA especially used to prevent bots from using various types of computing services. The applications include preventing bots from taking part in online polls, registering for free email accounts, more recently, preventing bot-generated spam by requiring that the (unrecognized) sender pass a CAPTCHA test before the email message is delivered [implemented in Yahoo]. They have also been used to prevent people from using bots to assist with massive downloading of content from multimedia websites. You have probably seen the CAPTCHA project in action at some of your Web destinations. Its principal tool is a randomly created image that contains a phrase unmentioned in computer-readable text on the rendered page. The form asks the user to provide the phrase. If the form post does not contain the correct phrase, you can safely assume either the human made a user error, or it wasn't a human at all. Now it's time to put this code to work. A simple and often-used interface to implement this new security measure is the form on website. In this form you typically capture random number. <code> Please enter the string shown in the image in the form.<br> </code> The following code use to create random numbers and this number are embedding with existing image file, the first line used to initiate session, which use to carry the user inputs. <code> </code> The second line [md5 (microtime ())] use to generate the random string, and the resultant string is trim by using third line [substr], which returns the portion of string specified by the start and length parameters. The function imagecreatefromjpeg ("img.jpg") is use to create a image by existing image file and as back ground ,so that you need to give an image file path. <code> </code> After creation of back ground image, we generate some linear line, which is use to avoid the phrasing from random numbers, the respective lines are create by the function named imageline () and imagestring () use to draw a random string horizontally. <code> </code> The resultant random number [trimmed one], carry through session especially for validation purpose. <code> </code> Finally above two functions are uses to display/out put the image to browser. So we can just call the particular file by through image source path, it will display the final image. <code> </code> I hope you know about the above code functionality, it s about validating the user in put and actual random number, depends upon the application you may use the if and else conditions, that s all Conclusion CAPTCHA can be a great way to limit the amount of successful, unwanted HTTP POST requests in your application, CAPTCHAs are by definition fully automated, requiring little human maintenance or intervention in administering the test. This has obvious benefits in cost and reliability; I hope the simple code is useful to understand the concept. Happy CAPTCHA-ing! <?php session_start(); $RandomStr = md5(microtime());// md5 to generate the random string $ResultStr = substr($RandomStr,0,5);//trim 5 digit $NewImage =imagecreatefromjpeg("img.jpg");//image create by existing image and as back ground $LineColor = imagecolorallocate($NewImage,233,239,239);//line color $TextColor = imagecolorallocate($NewImage, 255, 255, 255);//text color-white imageline($NewImage,1,1,40,40,$LineColor);//create line 1 on image imageline($NewImage,1,100,60,0,$LineColor);//create line 2 on image imagestring($NewImage, 5, 20, 10, $ResultStr, $TextColor);// Draw a random string horizontally $_SESSION['key'] = $ResultStr;// carry the data through session header("Content-type: image/jpeg");// out out the image imagejpeg($NewImage);//Output image to browser ?><?php session_start(); ?> <HTML> <HEAD> <TITLE>PHP-CAPTCHA </TITLE> <META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=iso-8859-1\"> </HEAD> <BODY onLoad="return focuson();"> <script language="javascript"> function focuson() { document.form1.number.focus()} function check() { if(document.form1.number.value==0) { alert("Please enter your Category Name"); document.form1.number.focus(); return false; } } </script> <?php if(isset($_REQUEST['Submit'])){ $key=substr($_SESSION['key'],0,5); $number = $_REQUEST['number']; if($number!=$key){ echo '<center><font face="Verdana, Arial, Helvetica, sans-serif" color="#FF0000"> Validation string not valid! Please try again!</font></center>';} else{ echo '<center><font face="Verdana, Arial, Helvetica, sans-serif" color="#66CC00"> Your string is valid!</font></center>';} } ?> <form name="form1" method="post" action="form.php" onSubmit="return check();"> <table width="342" align="center" cellspacing="0" bgcolor="#D4D0C8"> <tr> <td colspan="4" align="center"><hr></td> </tr> <tr> <td width="8" align="center"> </td> <td width="330" align="right" valign="top"> </td> <td width="330" align="right" valign="top"> </td> <td width="2" align="center"> </td> </tr> <tr> <td align="center"> </td> <td align="right" valign="top"> </td> <td align="right" valign="top"> </td> <td align="center"> </td> </tr> <tr> <td align="center"> </td> <td align="center"> </td> <td align="center"><img src="php_captcha.php"></td> <td align="center"> </td> </tr> <tr> <td align="center"> </td> <td align="center"> </td> <td align="center"> </td> <td align="center"> </td> </tr> <tr> <td align="center"> </td> <td align="center"> Please enter the string shown in the image in the form.<br></td> <td align="center"><input name="number" type="text" id=\"number\"></td> <td align="center"> </td> </tr> <tr> <td align="center"> </td> <td align="center"> </td> <td align="center"> </td> <td align="center"> </td> </tr> <tr> <td align="center"> </td> <td align="center"> </td> <td align="center"><input name="Submit" type="submit" value="Submit"></td> <td align="center"> </td> </tr> <tr> <td colspan="4" align="center"><hr></td> </tr> </table> </form> </BODY> </HTML>
A PHP implementation of the Secure Hash Algorithm, SHA-1, based on the JavaScript implementation by Paul Johnston. This is basically a "translation from JavaScript to PHP, so most of the credits should go to Paul Johnston. I only re-wrote it in PHP. See http://pajhome.org.uk/site/legal.html for details. <?php /* * sha-1.php * A PHP implementation of the Secure Hash Algorithm, SHA-1, based on * the JavaScript implementation by Paul Johnston. * This is basically a "translation from JavaScript to PHP, so most * of the credits should go to Paul Johnston. I only re-wrote it in PHP. * See http://pajhome.org.uk/site/legal.html for details. / / * Convert a 32-bit number to a hex string with ms-byte first / function hex($num) { $hex_chr = "0123456789abcdef"; $str = ""; for($j = 7; $j >= 0; $j--) $str .= $hex_chr{(($num >> ($j 4)) & 0x0F)}; return $str; } /* * Convert a string to a sequence of 16-word blocks, stored as an array. * Append padding bits and the length, as described in the SHA1 standard. / function str2blks_SHA1($str) { $nblk = ((strlen($str) + 8) >> 6) + 1; for($i = 0; $i < $nblk 16; $i++) $blks[$i] = 0; for($i = 0; $i < strlen($str); $i++) $blks[$i >> 2] \|= ord($str{$i}) << (24 - ($i % 4) * 8); $blks[$i >> 2] \|= 0x80 << (24 - ($i % 4) * 8); $blks[$nblk * 16 - 1] = strlen($str) * 8; return $blks; } /* * Bitwise rotate a 32-bit number to the left / // zeroFill() is needed because PHP doesn't have a zero-fill // right shift operator like JavaScript's >>> function zeroFill($a, $b) { $z = hexdec(80000000); if ($z & $a) { $a >>= 1; $a &= (~$z); $a \|= 0x40000000; $a >>= ($b-1); } else { $a >>= $b; } return $a; } function rol($num, $cnt) { return ($num << $cnt) \| (zeroFill($num, (32 - $cnt))); } / * Perform the appropriate triplet combination function for the current * iteration / function ft($t, $b, $c, $d) { if($t < 20) return ($b & $c) \| ((~$b) & $d); if($t < 40) return $b ^ $c ^ $d; if($t < 60) return ($b & $c) \| ($b & $d) \| ($c & $d); return $b ^ $c ^ $d; } / * Determine the appropriate additive constant for the current iteration / function kt($t) { return ($t < 20) ? 1518500249 : ( ($t < 40) ? 1859775393 : ( ($t < 60) ? -1894007588 : -899497514 ) ); } / * Take a string and return the hex representation of its SHA-1. */ function calcSHA1($str) { $x = str2blks_SHA1($str); $a = 1732584193; $b = -271733879; $c = -1732584194; $d = 271733878; $e = -1009589776; for($i = 0; $i < count($x); $i += 16) { $olda = $a; $oldb = $b; $oldc = $c; $oldd = $d; $olde = $e; for($j = 0; $j < 80; $j++) { if($j < 16) $w[$j] = $x[$i + $j]; else $w[$j] = rol($w[$j-3] ^ $w[$j-8] ^ $w[$j-14] ^ $w[$j-16], 1); $t = rol($a, 5) + ft($j, $b, $c, $d) + $e + $w[$j] + kt($j); $e = $d; $d = $c; $c = rol($b, 30); $b = $a; $a = $t; } $a += $olda; $b += $oldb; $c += $oldc; $d += $oldd; $e += $olde; } return hex($a) . hex($b) . hex($c) . hex($d) . hex($e); } ?>
Simple Auth Code For PHP4 <? # Simple Auth For PHP4 # I use mysql but you can change this to what ever you want to. # Reject All Anonymous Logins if((!$_POST[var_username]) \|\| (!$_POST[var_password])){ header("Location: http://some_file_or_address_here"); exit; } # Run Query $sql = mysql_query("select * from Table where Username='$_POST[var_username]' and Password='$_POST[var_password]'") or die (mysql_error()); $get = mysql_numrows($sql); if($get == "1"){ print("Auth Granted"); } else { $get="3"; } if($get == "0"){ print("Auth False"); } else { $get="3"; } if($get == "3"){ print("Log there ip or run some statement here. Dont just let them off the hook."); } ?>
This simple log in script will password protect one or more of your pages. You can allow different users to go to different sites. <!-- Save this as a simple *.html document with any name --> <form action="action.php" method="POST"> <font face="helvetica" color="black" size="3">Password: </font><input type="password" name="password" style="background: #4682B4; color: white" /> <br><br><input type="submit" value="Enter" style="background: #6495ED">&nbsp&nbsp<input type="reset" value="Reset" style="background: #6495ED"> </form> <!-- save this as action.php. change the variables $pass, and both the header("location: ") commands to whatever you would like. --> <?php $pass = "insertpasswordhere"; if ($_POST["password"] == $pass) { header ("Location: your/path/to/correctpasswordsite.php"); } else { header ("Location: your/path/to/wrongpasswordsite.php"); } ?>
Submit to this page from a form with a hidden field. Checks that field and your ip address. Good if its static. <?php $ip = GetHostByName($REMOTE_ADDR); if (($ip!="24.43.234.25")\|\|($cool!="some^&%$^%thing")) { echo "<script language='JavaScript'><!--\n"; echo " site='http://www.disney.com'\n"; echo "window.location.replace(site);\n"; echo "//--></script>\n"; } else{ echo date("l, F d, Y",time()); //ex.Friday, September 21, 2001 echo "<br><br><strong>Welcome YourName</strong><br>\n"; } ?>
If you want to use this code, please link back to www.officedevils.com - you don't have to, just a comment on your blog will do! <br><br> These two code fragments are pretty simple. It randomly generates two numbers, and adds them as hidden variables on your site's submission or sign-up form. The user then has to do the simple sum before the submission is accepted. <br><BR> Yes, you could write a grep to find the numbers and add them, and submit that, but I am sure that won't happen until a LOT of people start using this, and then you can simply move the variables, or add to it, so that the numbers are turned into words, or change the variable names, or change the sign.<br><br> You might also want to make the maths that little bit harder than adding a ten to a digit, to improve the quality of members you get!! ;-) <br><br> The big advantage is that this doesn't limit access to those without sight or graphics, such as disabled or WAP users, allowing you to still comply with the regs. on usage. <? // Anti-spam code to prevent bots signing up on common PHP based boards // without the server load of re-writing a gif // You may need to change some variable names if ((($number + $othernumber) != $sum)) { echo "<font color=red>Please learn basic maths!!</font><br>"; $send = "no"; // Add the form data variable names you want to deliberately forget unset($sender_email); unset($sender_name); unset($sender_phone); // End variables } $number = rand(1,10); $othernumber = rand(1,9)*10; //End anti-spam code ?> ?> //Anti-spam code in form $form_block .= " <input type=\"hidden\" name=\"number\" value=\"$number\"> <tr><td> To prove you are not a bot, please complete the sum $number + $othernumber = <input type=\"hidden\" name=\"othernumber\" value=\"$othernumber\"><input type=\"text\" name=\"sum\" size=3 maxlength=3>"; //End of anti-spam form additions ?>
TransCrypt is an encrytion library. It simply uses look up tables to translate bytes. The look up tables are generated by the LFSR algorithm. <? /* TransCrypt Encrytion functions Description: TransCrypt is an encrytion library. It simply uses look up tables to translate bytes. The look up tables are generated by the LFSR algorithm. Example: include("trans_crypt.php"); $secret = "I like encrytion"; $crypted_data = trans_encrypt($secret); $decrypted_data = trans_decrypt($crypted_data); echo "secret = $decrypted_data"; */ function trans_encrypt($data){ for($i = 0, $key = 27, $c = 48; $i <= 255; $i++){ $c = 255 & ($key ^ ($c << 1)); $table[$key] = $c; $key = 255 & ($key + 1); } $len = strlen($data); for($i = 0; $i < $len; $i++){ $data[$i] = chr($table[ord($data[$i])]); } return base64_encode($data); } function trans_decrypt($data){ $data = base64_decode($data); for($i = 0, $key = 27, $c = 48; $i <= 255; $i++){ $c = 255 & ($key ^ ($c << 1)); $table[$c] = $key; $key = 255 & ($key + 1); } $len = strlen($data); for($i = 0; $i < $len; $i++){ $data[$i] = chr($table[ord($data[$i])]); } return $data; } ?>
UA Blocker allows you to selectively deny specific user-agents from visiting your site. This helps to eliminate email harvesting, and various other bandwidth-sucking visitors. Some examples are included. <?php //UA BLOCK //By: Christopher Lover - webmaster@icehousedesigns.com //http://www.icehousedesigns.com //This script is freeware. I accept no responsibility for damage it may cause (which should be none). //This script can be freely modified, as long as this header is included. // Place <?php include ("/path/to/block.php3"); ?> at the TOP of your HTML documents //List user-agents below you wish to ban in correct format $browser = array ("Wget", "EmailSiphon", "WebZIP","MSProxy/2.0","EmailWolf","webbandit","MS FrontPage"); $punish = 0; while (list ($key, $val) = each ($browser)) { if (strstr ($HTTP_USER_AGENT, $val)) { $punish = 1; } } //Be sure to edit the e-mail address and custom page info below if ($punish) { // Email the webmaster $msg .= "The following session generated banned browser agent errors:\n"; $msg .= "Host: $REMOTE_ADDR\n"; $msg .= "Agent: $HTTP_USER_AGENT\n"; $msg .= "Referrer: $HTTP_REFERER\n"; $msg .= "Document: $SERVER_NAME" . $REQUEST_URI . "\n"; $headers .= "X-Priority: 1\n"; $headers .= "From: Ban_Bot <bot@yourdomain.com>\n"; $headers .= "X-Sender: <bot@yourdomain.com>\n"; mail ("webmaster@yourdomain.com", "BANNED BROWSER AGENT ERROR", $msg, $headers ); // Print custom page echo "<HTML> <head> <title>Access Denied</title> </head> <p>We're sorry. The software you are using to access our website is not allowed. Some examples of this are e-mail harvesting programs and programs that will copy websites to your hard drive. If you feel you have gotten this message in error, please send an e-mail addressed to admin. Your I.P. address has been logged Thanks.</p> <BR> -Yourname <BR> </body> </HTML>"; exit; } ?>
A complete modual for you to wrap around anything that you want secure. Wiggem uses php's new session functions and is much more secure then the average cookie login script. Md5 encryption is also used. session_start(); session_register('isloggedin'); session_register('username'); session_register('cnt'); global $isloggedin , $dbhost, $dbuser, $dbpasswd, $dbname; /* you must change the below variables to allow the connection to your database / $dbhost = "localhost"; $dbuser = "login"; $dbpasswd = "password"; $dbname = "DBname"; / To Create the MYSQL table run this SQL CREATE TABLE users (id INT not null AUTO_INCREMENT, name TEXT not null , pword TEXT not null , PRIMARY KEY (id), INDEX (id), UNIQUE (id)) / function login($username,$password) { global $isloggedin , $dbhost, $dbuser, $dbpasswd, $dbname; / Usage login($username,$password) will test the input from a form and check it agains a pre existing database with user names and passwords in then this will incode it using the md5 standard (see nerd handbook) of encryption. Returns: true and sets the global session variable $isloggedin false and you can do whatever you like with them / //Data base connection. $cnx = mysql_connect($dbhost,$dbuser,$dbpasswd) or die("Problem In first connection"); mysql_select_db($dbname,$cnx) or die(mysql_error()); $hash= md5($password); //encrypting the password $query1= "select from users WHERE name = '$username' AND pword = '$hash'"; $result = mysql_query($query1) or die (mysql_error()); // boring old mysql query execution if (!$result \|\| mysql_num_rows($result) < 1){ // if there is no results returned then there wasn't a match, do your worst! return false; } else { while(list($id, $name, $pword, $cnt) = mysql_fetch_row($result)){ $cnt++; $update = "UPDATE cnt SET cnt='$cnt' WHERE id='$id'"; $result2 = mysql_query($update); } if (!$isloggedin){ $hashvar = date("F d, Y H"); //setcookie('isloggedin',md5($hashvar),time()+(1 * 60 * 60),'/','',0); //take the comment out to use cookie version $isloggedin = md5($hashvar); return true; } else { //If it is there then just update the variables $hashvar = date("F d, Y H"); $isloggedin = md5($hashvar); } } } function testlogin(){ /* This function will test to see if the user has logged in or not. This must be used on all pages that are secure If this function is not used then you are not inside the login program. USAGE: testlogin(); if (testlogin()){ do secure stuff; } else{ do unsecure stuff; } RETURNS: 1 if true and user is logged in false if they are not / global $isloggedin; $hashvar = date("F d, Y H"); $crosscheck = md5($hashvar); if ($crosscheck == $isloggedin){ return 1; } else { return false; } } function newuser($username,$password){ / This function is used to create new users. It takes in a username and password then encrypts the password and stores it in a mysql database (SEE CREATE TABLE CODE ON LINE 7). Returns 1 IF everything went ok Returns 2 if There was an error Returns 3 if that user already exists / global $isloggedin , $dbhost, $dbuser, $dbpasswd, $dbname; $cnx = mysql_connect($dbhost,$dbuser,$dbpasswd) or die("Problem In first connection"); mysql_select_db($dbname,$cnx) or die(mysql_error()); $query1= "select from users WHERE name = '$username'"; $result= mysql_query($query1) or die(mysql_error()); if (!$result \|\| mysql_num_rows($result) >= 1){ // if there is no results returned then there wasn't a match, do your worst! $feedback = 3; return $feedback; } else { $hash= md5($password); $query = "Insert into users (name,pword) VALUES ('$username','$hash')"; $result = mysql_query($query) or die(mysql_error()); if ($result){ return 1; } else{ return 2; } } }
A very simple fuction to detect files encoded with Zend encoder. function checkZencode($yourfile) { $fp=fopen($yourfile,"ab+"); $beg=substr(fgets($fp,5),0,4); fclose($fp); if ($beg == "Zend") { $beg = "file encoded with Zend encoder"; } else { $beg = "file not encoded"; } return $beg; }

php.ComLanka.com PHP Tutorial ,PHP source code, PHP online example