New PHP site, can you break it?

jplush76

Hey guys, I just finished a new ecommerce website with php and I was hoping someone in here could find some exploits or code errors. Kind of a "dare you to break it" type thing.

Its in testing right now but I just want to make sure there is nothing serious happening.

The entire shopping system was handcoded completely from scratch.

Thanks everyone!

http://63.205.100.36/

coditoergosum

Hardcoded? So it doesn't load anything dynamically? What's the point of using scripting if you're going to hardcode it?

jplush76

lol look closer man, it says "HANDCODED" not hardcoded 🙂

I mean I didn't use any scripts from the net, I wrote all the objects and in line code line by line

coditoergosum

Haha. Ok, handcoded. Haha. Looks very close to hardcoded. My bad.

I mean I didn't use any scripts from the net, I wrote all the objects and in line code line by line

I would hope so... that's what being a PHP developer means. I feel like anything that is being used for commercial purposes should be "handcoded", or the person that wrote the original script should be compensated.

jaimz

it's really nice, i just don't likt the flash into, it all seemed to work though

theeper

Your site looks nice and functions well. There was one minor bug I noticed. By changing the pid number in your cart to a negative number, I was able to add nonexistant items to my cart. Not sure how this would ultimately affect your cart, cause I didn't sign up or anything. But if you use a URL like this...

https://63.205.100.36/sc_shop.php?pid=-1&do=Add

You can see what I mean. You may wanna validate the pid before doing any operation with it. Also, play around with your other URLs and make sure they can't be manipulated as well.

jplush76

yea the flash intro wasnt my idea either 🙁 the boss wanted it. I friggen hate it, looks dumb.

thanks peeper, I'll check into that URL thing! Some already caught that they could add negative numbers to the url string to add negative product qty's and they could checkout with free products. lol

I fixed that, but it could have been bad 🙂

Jeepsta

I dont like the "Shop Now" button when you are viewing your shopping cart. I see that it uses javascript:history.back() but if you are messing around in the cart (ie deleting items, adding quantities, etc) it just takes you back one page. How about directing it to the main page for shopping or something. Just a thought.

Zach