security

[slimjim]

Ok second time posting this. I have this script below. I need to know how to stop people from entering this +30000

Right now when they take credits and move them into a campaign they put in something like this 250.00 .. but if they do this 250.00+3000 they can actually give themselves 3000 credits.

Can anyone look at this code below and tell me a fix for my problem.

<?
	if($action == "store_credits"){

		  switch($act){
		      case "store":
		        $ff = f(q("select * from prev where cid='$id'"));
			if($ff["prev_number"] != ""){
				if($count>$ff["prev_number"])
					echo "<center><font color=CC0000 style='font-size:14px'><b>Invalid value entered! Value must be from 1 to $ff[prev_number] for this campaign.</b></font><br><br><br></center>";
				else {
					if(e(q("select id from members_credits where user_id='$user[id]'")))
						q("insert into members_credits values('0','$user[id]','$count')");
					else
						q("update members_credits set credits_num=credits_num+$count where user_id='$user[id]'");
					q("update prev set prev_number=prev_number-$count where cid='$id'");
				}
			}

			break;
		      case "add":

			$ff = f(q("select * from members_credits where user_id='$user[id]'"));
			if($ff["credits_num"] != ""){
				if($count > $ff["credits_num"])
					echo "<center><font color=CC0000 style='font-size:14px'><b>Invalid value entered! Value must be from 1 to $ff[credits_num].</b></font><br><br><br></center>";
				else {
				 	if(e(q("select id from prev where cid='$id'")))
						q("insert into prev values('0','$id','$count')");
					else
						q("update prev set prev_number=prev_number+$count where cid='$id'");

					q("update members_credits set credits_num=credits_num-$count where user_id='$user[id]'");
				}
			}

			break;
		  }
}

$stored_credits = @f(q("select * from members_credits where user_id='$user[id]'"));	
$in_campaigns = f(q("select sum(p.prev_number) as su from campaigns c,prev p where c.id=p.cid and c.user_id='$user[id]' and c.status='1' group by c.user_id;"));	
$summ = $stored_credits["credits_num"] + $in_campaigns["su"];?>
<table border=0 width=350>
<tr><td><b>Total credits in your profile:</b></td><td><? echo (float)$summ; ?> credits</td></tr>
<tr><td><b>Credits stored:</b></td><td><? echo (float)$stored_credits["credits_num"]; ?> credits</td></tr>
<tr><td><b>Credits in campaigns detailed:</b></td><td><? echo (float)$in_campaigns["su"]; ?> credits</td></tr>
</table>

<?
   $r = q("select * from campaigns where user_id='$user[id]' and status='1'");

   if(e($r)){
     	echo "<div align=center><b>You do not have approved campaigns!</b></div>";
   } else {
	echo "<table border=0 cellspacing=3 cellpadding=3 align=center>";
	echo "<tr><td></td><td>Campaign</td><td>Credits</td></tr>";
	$i = 1;
        while($ff = f($r)){
		$credits = f(q("select * from prev where cid='$ff[id]'"));
		echo "<tr><td align=center height=24>$i.</td><td><a href=index.php?src=$src&cid=$ff[id]>$ff[title]</a><br><font color=888888> ($ff[url])</td><td>$credits[prev_number]</td>";
		echo "<form action='index.php?src=credits_man&action=store_credits&id=$ff[id]' method=post>";
		echo "<td><input type=text name=count value='$credits[prev_number]' size=6> <input type=submit value='store' name=act> <input type=submit value='add' name=act></td>";
		echo "</form>";
		echo "</tr>\n";
		$i++;	
	}
	echo "<tr><td>&nbsp;</td></tr>";
	echo "<tr><td colspan=3>Total ".($i-1)." campaign(s)</td></tr>";
	echo "</table>";
   }
?>
<br>
<B>Trusted members</b> can transfer credits to other member accounts. Usually, only important, well known advertisers will receive this status, on request. Contact admin to find out more about the <b>trusted status</b>.
</blockquote>

[danielson2k]

Are the users entering the number of credits into a form?

If so, why not use strpos() to find out the position of a + (or ) then use substr() to remove everything from the + or onwards?

Therefore 250+3000 would become 250.

[slimjim]

can you give me an example because i am not really sure if i understand you at all.

[slimjim]

Form is below

echo "<tr><td align=center height=24>$i.</td><td><a href=index.php?src=$src&cid=$ff[id]>$ff[title]</a><br><font color=888888> ($ff[url])</td><td>$credits[prev_number]</td>";
		echo "<form action='index.php?src=credits_man&action=store_credits&id=$ff[id]' method=post>";
		echo "<td><input type=text name=count value='$credits[prev_number]' size=6> <input type=submit value='store' name=act> <input type=submit value='add' name=act></td>";
		echo "</form>";
		echo "</tr>\n";

[danielson2k]

Ok, if somebody puts "250+30000" into the form, is the variable you recieve from the form "250+30000" or "30250"?

[slimjim]

if they put in 250.00+3000 what is returned is 3250

[danielson2k]

Right, you gotta use Javascript to make sure nobody sticks any mathematical symbols in:

First, give the input an id property, ie:

<input type="text" name="count" id="count" etc...>

Next add and id property to the form, ie:

<form action="index.php" id="countform" etc...>

then stick the following javascript into the page:

<script language="Javascript">

function checkform(){

            var inputid = document.getElementById('count').value

if(inputid.indexOf("+")!=-1 || inputid.indexOf("-")!=-1 || inputid.indexOf("*")!=-1 || inputid.indexOf("/")!=-1){

	alert("You must not use any mathematical characters!");

} else {

	document.getElementById('countform').submit();

}

}

</script>

This should do the job.

[Natty_Dreadlock]

javascript is ok when it's for some site. However, if u wanna check "real money", javascript checks can be disabled just by setting the browser's javascript support to off. So a serverside check -as danielson2k wants u to use- is a lot more secure..

[slimjim]

Well I am not sure what I am doing wrong with this form but it's not working. Any help Please ?

<?
global $action;
?>
<script language="Javascript"> 

function checkform(){ 

            var inputid = document.getElementById('count').value 

if(inputid.indexOf("+")!=-1 || inputid.indexOf("-")!=-1 || inputid.indexOf("*")!=-1 || inputid.indexOf("/")!=-1){ 

    alert("You must not use any mathematical characters!"); 

} else { 

    document.getElementById('countform').submit(); 

} 

} 

</script>

<blockquote>
<font style="font-size:14px"><b>Credits management:</b></font><br>
<br>You can manage credits for your profile and transfer earned/bought credits to your campaigns.<br>
Also you can store credits for some time and then to use them.<br><br>
To place credits to your profile basket from some of the campaigns click <b>Store</b> button,
and to transfer credits from basket to some of your campaigns click <b>Add</b> button.
<br> If credits reserved to a campaign drop below 0, that campaign will receive no traffic until credits are raised again above 0.
<br><br><br>
<?
	if($action == "store_credits"){

		  switch($act){
		      case "store":
		        $ff = f(q("select * from prev where cid='$id'"));
			if($ff["prev_number"] != ""){
				if($count>$ff["prev_number"])
					echo "<center><font color=CC0000 style='font-size:14px'><b>Invalid value entered! Value must be from 1 to $ff[prev_number] for this campaign.</b></font><br><br><br></center>";
				else {
					if(e(q("select id from members_credits where user_id='$user[id]'")))
						q("insert into members_credits values('0','$user[id]','$count')");
					else
						q("update members_credits set credits_num=credits_num+$count where user_id='$user[id]'");
					q("update prev set prev_number=prev_number-$count where cid='$id'");
				}
			}

			break;
		      case "add":

			$ff = f(q("select * from members_credits where user_id='$user[id]'"));
			if($ff["credits_num"] != ""){
				if($count > $ff["credits_num"])
					echo "<center><font color=CC0000 style='font-size:14px'><b>Invalid value entered! Value must be from 1 to $ff[credits_num].</b></font><br><br><br></center>";
				else {
				 	if(e(q("select id from prev where cid='$id'")))
						q("insert into prev values('0','$id','$count')");
					else
						q("update prev set prev_number=prev_number+$count where cid='$id'");

					q("update members_credits set credits_num=credits_num-$count where user_id='$user[id]'");
				}
			}

			break;
		  }
}

$stored_credits = @f(q("select * from members_credits where user_id='$user[id]'"));	
$in_campaigns = f(q("select sum(p.prev_number) as su from campaigns c,prev p where c.id=p.cid and c.user_id='$user[id]' and c.status='1' group by c.user_id;"));	
$summ = $stored_credits["credits_num"] + $in_campaigns["su"];?>
<table border=0 width=350>
<tr><td><b>Total credits in your profile:</b></td><td><? echo (float)$summ; ?> credits</td></tr>
<tr><td><b>Credits stored:</b></td><td><? echo (float)$stored_credits["credits_num"]; ?> credits</td></tr>
<tr><td><b>Credits in campaigns detailed:</b></td><td><? echo (float)$in_campaigns["su"]; ?> credits</td></tr>
</table>

<?
   $r = q("select * from campaigns where user_id='$user[id]' and status='1'");

   if(e($r)){
     	echo "<div align=center><b>You do not have approved campaigns!</b></div>";
   } else {
	echo "<table border=0 cellspacing=3 cellpadding=3 align=center>";
	echo "<tr><td></td><td>Campaign</td><td>Credits</td></tr>";
	$i = 1;
        while($ff = f($r)){
		$credits = f(q("select * from prev where cid='$ff[id]'"));
		echo "<tr><td align=center height=24>$i.</td><td><a href=index.php?src=$src&cid=$ff[id]>$ff[title]</a><br><font color=888888> ($ff[url])</td><td>$credits[prev_number]</td>";
		echo "<form action='index.php?src=credits_man&action=store_credits&id=$ff[id]' id=countform' method=post>";
		echo "<td><input type=text name=count id=count value='$credits[prev_number]' size=6> <input type=submit value='store' name=act> <input type=submit value='add' name=act></td>";
		echo "</form>";
		echo "</tr>\n";
		$i++;	
	}
	echo "<tr><td>&nbsp;</td></tr>";
	echo "<tr><td colspan=3>Total ".($i-1)." campaign(s)</td></tr>";
	echo "</table>";
   }
?>
<br>
<B>Trusted members</b> can transfer credits to other member accounts. Usually, only important, well known advertisers will receive this status, on request. Contact admin to find out more about the <b>trusted status</b>.
</blockquote>

[danielson2k]

try changing

id=countform'

to

id='countform'

[slimjim]

Still same problem

[danielson2k]

What exactly is the problem?

[slimjim]

ok on my form page it has this :
Total credits in your profile: 94095 credits
Credits stored: 92095 credits
Credits in campaigns detailed: 2000 credits

now also it has a text area in the form that echos the credits in that campaign

Next to that it has a submit ad button and a submit store button

stored credits are credits i can still use for a campaign or different campaigns

if i put in that box any figures WTIH THE + IT ADS UP IN THE PROFILE

[slimjim]

they are able to force credits they have not earned into thier account. Is the problem. I have been at this for so long I am going crazy. I cant figure out how to stop it from happening.

The idea that you have Danial should work unless I am missing something simple and dumb.

[danielson2k]

EEK!

No, you're not missing anything - apart from the main code to make the javascript work 😛

You also have to add the following to the <form> tag so it becomes:

<form action='index.php?src=credits_man&action=store_credits&id=$ff[id]' id='countform' method=post onSubmit="JavaScript: checkform()">

(there should be no space inbetween "java" and "script" the board software put it there for some reason...

This actually calls the checkform() function when the form is submitted - really quite an important part!

[slimjim]

Great that worked.. but 🙁

it seems to work only for the first campaign.

If I have three campaigns i can still use + for the other 2

[slimjim]

Nope that isnt working either... I just was testing it more. The warning window pops up but still adds the credits.

Now you see why I am going nuts.. Everything It seems I am doing isn't working.

[slimjim]

Danial you feel like earning $20 ?

[danielson2k]

The Javascript:

<script language="javascript">

function checkform(){ 

var inputid = document.getElementById('count').value 

if(inputid.indexOf("+")!=-1 || inputid.indexOf("-")!=-1 || inputid.indexOf("*")!=-1 || inputid.indexOf("/")!=-1){ 

    alert("You must not use any mathematical characters!"); 

    document.getElementById('count').focus();

} 

} 

</script>

The form:

echo "<form action='index.php?src=credits_man&action=store_credits&id=$ff[id]' method=post>"; 
echo "<td><input type=text name=count value='$credits[prev_number]' size=6 onBlur='javascript: checkform()'> <input type=submit value='store' name=act> <input type=submit value='add' name=act></td>"; 
echo "</form>";

(once again, there should be no space in between 'java' and 'script' in the onBlur part of the form.)