PHP help

[Mado]

I've got some php code my dad wrote/put together a few years ago for my website. I kind of understand what its trying to do, but not well enough to change it so it works with my current website. I had to change the way my links worked from www.planetmado.com/?page=whatever to www.planetmado.com/whatever.php. This messed with how the code my dad wrote calls up different pages, obviously. One thing he wrote is a password system. It doesn't use mysql, just a text file. Part of the code changes the user's password to an encoded version (you have to do this manually). Part of it is the actual log-in page. And every member's page is different, they don't all go to the same page.

The other code he wrote is so members can update their own pages by clicking a link. This code detects a few different things from the member's page, which determines which links show up on their page and how it is calculated.

The encoding script for passwords:

<?php
#phpinfo();
session_start();
$a = $_SERVER["SCRIPT_FILENAME"];
$b = $_SERVER["PHP_SELF"];
echo "<p>$a<p>";
echo "<p>$b<p>";

$test = "dougherty";
session_register("test");
for ($r = 0; $r <= 0; $r++) {
echo "$_SESSION[test]<p>";
}
$mike = '  999 Beans';
$mike2 = substr("$mike",3,1);
if (is_numeric($mike2)) { echo "it is numeric<p>";} else echo "not numeric<p>";
##################################################################
$unique_str = md5(superman);
echo "Here is the encrypted password to copy to apl.old   <p>";
echo "$unique_str<p>";
##################################################################

#$doit = crypt("silver"); # let salt be generated
$infile = "apl.old";
$name = 'mdorty';
$password = 'silver';
$nlen = strlen($name);
$fp = fopen("$infile","r");
if (!$fp) {
    echo "<p>Unable to open remote file for read.\n";
 }
while (!feof ($fp) and ($done != '1')) {
                    $line = fgets ($fp, 1024);
                    $user = substr($line,0,$nlen);
echo "$user<p>";
                     if ($name == $user) {
echo "equal<p>";
                      $len = strlen($line);
                      $newlen = $len - 36;
                      $new = substr($line,0,$newlen);
                      $salt = substr($line,($newlen + 1),34);
 $new1 = crypt($password);
echo "$new1<p>"; 
 if (crypt($password,$salt) == $salt) {
    echo "Password verified!<p>";
$pass = crypt($password,$salt);
$done = 1;
                                     }
                    }
      }
echo "--------------------------------------------------------------------------<p>";


$password = crypt("exnamek"); # let salt be generated
echo "<p>$password<p>";
$user_input = "silver";
 $new = crypt($user_input); 
 echo "<p>$new<p>";                     

 if (crypt($user_input,$password) == $password) {
    echo "Password verified!<p>";
$pass = crypt($user_input,$password);
echo "$pass";
      }

?>

Here is the code that is activated after the member clicks the "log-in" button:

<?php
session_start();
session_unregister('endtrain');
$infile = "apl.old";
$nlen = strlen($name);
#echo "$name<p>";
#echo "$password<p>";
$fp = fopen("$infile","r");
if (!$fp) {
    echo "<p>Unable to open remote file for read.\n";
 }
while (!feof ($fp) and ($done != '1')) {
                    $line = fgets ($fp, 1024);
                    $user = substr($line,0,$nlen);
#echo "$user";echo "$name<p>";
                     if ($name == $user) {
                      $len = strlen($line);
                      $newlen = $len - 34;
                      $new = substr($line,0,$newlen);
                      $salt = substr($line,($newlen + 1),32);
#echo "$new<p>";echo "$salt<p>";
 $new1 = md5($password); 
 if (md5($password) == $salt) {
 $verify = md5($password);
#$logon = "logon";
#session_register("logon");
session_register("verify");
session_register("new");

#   echo "Password verified!<p>";
header("Location: http://www.planetmado.com/index.php");
#header("Location: http://www.planetmado.com/$new.php");
$pass = crypt($password,$salt);
                                     }
                    }
      }

fclose($fp);
if ($password != $pass) {
echo "NAME OR PASSWORD INCORRECT!<p>";
#exit;
}
?> 

This is what is in apl.old:

Cloud929261 07431a0a7d43aad72038efa2047278eb

[Mado]

Here is some of the code that updates a member's page:

<?php
session_start();
$ver = ("$_SESSION[verify]");
$endtrain = 'end';
session_register("endtrain");
if ( $ver == '' ) {exit;}
$outfile = ("$_SESSION[new].php");
?>
<html>
<head>
<body bgcolor="#FFFFFF" text="#4F6672" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<b><font face="Arial, Helvetica, sans-serif" size="-1">
 <a href="http://www.planetmado.com/agood.php?page=<?php echo "$page"; ?>"><u>TRAIN</u></a>&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="http://www.planetmado.com/index.php?page=<?php echo "$page"; ?>"><u>END TRAINING</u></a><br> 
<?php if ( $ver == '' ) {exit;}
$fp = fopen("$outfile","r");
if (!$fp) { echo "<p>Unable to open remote file for read.\n"; }
$x = 0;
$per = .01;
while (!feof ($fp)) {
                    $line = fgets ($fp, 1024);
                    $array[$x] = $line;
#                     echo "$array[$x]";
                      $x = $x + 1;                         

                    }
                    for ($w = 0; $w <= $x; $w++) {
                       $possensu = strpos($array[$w], "Sensu");
                         $possayia = strpos($array[$w], "Saiyan");
                         if ($possayia == 13) {$per = .06;}
                         $possplanet = strpos($array[$w], "Planet");
                         if ($possplanet == 3) {
                                                $lenplan = strlen($array[$w]);
                                                $planlen = ($lenplan - 6) - 14;
                                                $planet = substr($array[$w],15,$planlen);}
                         $possemail = strpos($array[$w], "E-mail");
                         if ($possemail == 3) {
                                                $lenmail = strlen($array[$w]);
                                                $maillen = ($lenmail - 6) - 22;
                                                $email = substr($array[$w],23,$maillen);}
                       $posweight = strpos($array[$w], "Weight");
                         if ($posweight == 3) {
                          $postype = strpos($array[$w], "Shirt");
                           if ($postype != '0') {$per = $per + .03; $postype = '0';}
                          $postype = strpos($array[$w], "Pants");
                           if ($postype != 0) {$per = $per + .04; $postype = '0';}                                               

                          $postype = strpos($array[$w], "Shoes");
                           if ($postype != 0) {$per = $per + .02; $postype = '0';}                                                

                          $postype = strpos($array[$w], "Belt");
                           if ($postype != 0) {$per = $per + .02; $postype = '0';} 
                          $postype = strpos($array[$w], "Hat");
                           if ($postype != 0) {$per = $per + .025; $postype = '0';} 
                          $postype = strpos($array[$w], "Wrist");
                           if ($postype != 0) {$per = $per + .02; $postype = '0';} 
                          $postype = strpos($array[$w], "Socks");
                           if ($postype != 0) {$per = $per + .015; $postype = '0';}                                             

                                            }
                               }


for ($r = 0; $r <= $x; $r++) {
$pos1 = strpos($array[$r], "Level");
if ($pos1 == 9) {
$of = strpos($array[$r], "of");
$end1 = $of - 6;
$pos2 = $of + 3;
$len = strlen($array[$r]);
$pos1 = $pos1 + 11;
$end2 = $len - 6;
$powrlen = ($end1 - $pos1) + 1;
$baselen = ($end2 - $pos2) + 1;
$powr = substr("$array[$r]",$pos1,$powrlen);
$powr = str_replace(",","",$powr);
if ($powr <= 0) {
echo "<p>you are still dead";
exit;
}
                 }
                             }
for ($t = 0; $t <= $x; $t++) {
                    $ltrn = strpos($array[$t], "Date Trained");
                     if ($ltrn ==8) {
 $adjh = (1 * 60 * 60);
 $todayh = date("m/d/Y H:i",time() - $adjh);
 $lasth = substr("$array[$t]",26,16);
if ($todayh < $lasth) {echo "YOU MAY ONLY TRAIN ONCE PER HOUR!"; exit;}
                      $adj = (72 * 60 * 60);
                      $today = date("m/d/Y H:i",time() - $adj);
                      $last = substr("$array[$t]",26,16);
                       if ($today >= $last) {
$of1 = strpos($array[1], "of");
$e1 = $of1 - 6;
$p2 = $of1 + 3;
$ln = strlen($array[1]);
$e2 = $ln - 6;
$dif = $e1 - 19;
$dif2 = $e2 - $p2 +1;
$np = substr($array[1],$p2,$dif2);
$array[1] = substr_replace($array[1], $np,20,$dif);
                                            }
                                     }
                              }
$pos1 = '0';
$of = '0';
$end1 = '0';
$pos2 = '0';
$len = '0';
$end2 = '0';
$powrlen = '0';
$baselen = '0';
$powr = '0';
#echo "===============================================================================<p>";
for ($y = 0; $y <= $x; $y++) {

$pos1 = strpos($array[$y], "Level");
if ($pos1 == 9) {
$of = strpos($array[$y], "of");
$end1 = $of - 6;
$pos2 = $of + 3;
$len = strlen($array[$y]);
$pos1 = $pos1 + 11;
$end2 = $len - 6;
$powrlen = ($end1 - $pos1) + 1;
$baselen = ($end2 - $pos2) + 1;
$powr = substr("$array[$y]",$pos1,$powrlen);
$powr = str_replace(",","",$powr);
if ($powr <= 0) {
echo "you are still dead<p>";
exit;
}
$base = substr("$array[$y]",$pos2,$baselen);
$base = str_replace(",","",$base);
$adj = round($base * $per);
$newbase = round($base + $adj);
$newpowr = $powr - $adj;
if ($newpowr <= 0) {
$deaddate = date("m/d/Y h:i a",time());
echo "<p>you are dead";
echo "<p>$deaddate<p>";
$newpowr = 0;
$possm = '0';
                    for ($z = 0; $z <= $x; $z++) {
                    $posd = strpos($array[$z], "ied:");
                    if ($posd == 4) {
                   $possm = strpos($array[$z], "m");
                   $deadt = substr("$array[$z]",13,($possm - 32));
                   $lend = strlen($deadt);
                   $deadt = str_replace(",","",$deadt);
                   $deadt = $deadt + 1;
                   $deadt = number_format($deadt);
                   $array[$z] = substr_replace($array[$z], $deadt,13,($possm - 32));
                   $array[$z] = substr_replace($array[$z], $deaddate,(14 + $lend),19);

$fd = fopen("dead.txt","a");
if (!$fd) {
    echo "<p>Unable to open remote file for write.";
    exit;
}
if($fd) {
$dead = "$outfile  $deadt  $deaddate  $planet  $email\n";
fputs($fd, $dead, 1024);
}
fclose($fd);
                                    }
                                                 } 
                   }

                for ($z = 0; $z <= $x; $z++) {
                $train = strpos($array[$z], "Date Trained");
                if ($train == 8) {
                $traindate = date("m/d/Y H:i",time());
                $array[$z] = substr_replace($array[$z],  $traindate,26,16);
                                 }
                                             } 
$newbase = number_format($newbase);
$newpowr = number_format($newpowr);
$array[$y] = substr_replace($array[$y], $newbase, $pos2, $baselen);
$array[$y] = substr_replace($array[$y], $newpowr, $pos1, $powrlen);
$pos = 0;
}
}
fclose($fp);
$fp = fopen("$outfile","w+");
if (!$fp) {
    echo "<p>Unable to open remote file for write.";
    exit;
}
if($fp) {
for ($y = 0; $y <= $x; $y++) {
fputs($fp, $array[$y], 1024);
echo "$array[$y]";
}
}
fclose($fp);
?>

[foyer]

Not really sure of your question, but

www.planetmado.com/?page=whatever to www.planetmado.com/whatever.php

the first link calls index.php?page=whatever
the second calls for whatever.php

So you would have to actually physically create this file, with the code it needs to process.

[Mado]

Right, I've done that part. My question is in regards mostly to this part of the code, I think:

#   echo "Password verified!<p>"; 
header("Location: http://www.planetmado.com/index.php"); 
#header("Location: http://www.planetmado.com/$new.php"); 
$pass = crypt($password,$salt);

Once the user inputs their name and correct password, I want it to redirect to their stat page, which would look something like this: www.planetmado.com/Mado123456.php I've already tried just uploading the script and it doesn't work. In regards to the rest of the code, should the code I just quoted point the user to his/her individual stat page?
Also for the code that provides a link to update a user's stat page, I get this error message:
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/planetma/public_html/layout.php:9) in /home/planetma/public_html/agood.php on line 2

Warning: Unknown: Your script possibly relies on a session side-effect which existed until PHP 4.2.3. Please be advised that the session extension does not consider global variables as a source of data, unless register_globals is enabled. You can disable this functionality and this warning by setting session.bug_compat_42 or session.bug_compat_warn to off, respectively. in Unknown on line 0

[foyer]

You might want to rethink how this is going to work. Working with pages on multiple files can be a real pain. Not to mention, i would consider it a security issue by giving away all your file locations.

Idealy, you want index.php?page=mypage over mypage.php.

[Mado]

foyer;10912179 wrote:

You might want to rethink how this is going to work. Working with pages on multiple files can be a real pain. Not to mention, i would consider it a security issue by giving away all your file locations.

Idealy, you want index.php?page=mypage over mypage.php.

Right, and that's the way it used to be set up. I came to the conclusion (maybe I'm wrong?) that the $page is no longer usable on some servers due to security issues. Since its not a predefined variable, I read that an attacker could put any code after the www.planetmado.com/?page= page to potentially attack the site/server. If I could still use the $page variable, I don't think any of this would be an issue.

[NogDog]

Yes, someone could put anything into the URL, thus it is the developer's responsibility to filter/validate any such input and reject it if it's invalid. For example:

<?php
$pageDir = $_SERVER['DOCUMENT_ROOT'].'/path/to/pages/';
if(basename($_GET['page']) != $_GET['page'] or !file_exists($pageDir.$_GET['page']))
{
   header("HTTP/1.0 404 Not Found");
   exit;
}
// go ahead and process page using $_GET['page'] . . .

[foyer]

Exactly, it's your duty to protect your site.

here's another example

if ($_REQUEST['page'] == 'home')
{
    require 'pages/home.php';
}

ect.. ect..

Also, yes someone could modify the URL, but it works the same way with forms. You could submit a form via a URL without even using the HTML form itself. So protect all unexpected variables.

[Mado]

So with either of those two examples you guys posted, I could still use the ?page= in the url? That's what I'm understanding, anyway. Sorry for my relative lack of knowledge in php. I understand a bit to an extent, but obviously not enough to do a whole lot. Just to get the basic idea of what a piece of code is doing.

[NogDog]

Yes, the point I was trying to make is simply that if you use such a method, you need to take steps to ensure that you have logic in place to only access files you want to be accessible by such a method and not blindly use whatever value is received. As a simple example, suppose this is the PHP script:

<?php
include "pages/" . $_GET['page'];
?>

Now suppose that someone tries accessing that page as "script.php?page=../../../../etc/passwd". If they guess right as to how many directory levels to move up and that there is a typical UNIX-type password file "/etc/passwd", they might be able to view it. In my prior example I was rejecting the request if there was any sort of directory info prepended to the file name.

Foyer's example took a more rigorous approach which is to compare the value to a known, limited set of allowed values. (Such values could be in an array or even in a database table, removing the need to do a bunch if if()'s or a switch.)

[Mado]

Okay, I guess I'm even more clueless than I thought. I put the following code in the members.php file:

<?php 
$pageDir = $_SERVER['DOCUMENT_ROOT'].'/home/planetma/public_html/'; 
if(basename($_GET['page']) != $_GET['page'] or !file_exists($pageDir.$_GET['page'])) 
{ 
   header("HTTP/1.0 404 Not Found"); 
   exit; 
} 
?>

Then I put this code in the layout.php file where I wanted the members.php file to be included:

<?php include ("$page"); $page = $page; ?>

And I used the following url to try to call it up: www.planetmado.com/layout.php?page=members.php

And I got the following error message:
Warning: include() [function.include]: Filename cannot be empty in /home/planetma/public_html/layout.php on line 104

Warning: include() [function.include]: Filename cannot be empty in /home/planetma/public_html/layout.php on line 104

Warning: include() [function.include]: Failed opening '' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in /home/planetma/public_html/layout.php on line 104

Line 104 is where the php include code was entered on the layout.php file. What did I do wrong?

[foyer]

<?php include ("$page"); $page = $page; ?> 

What is the purpose of this?

If this is an entire script it is not going to work. It will include "$page" which seems non-existant, then after it tries to include that, it will make $page = $page which is pointless.

[Mado]

Well, I tried it several different ways, but none of them worked. I tried just putting this in layout.php where I wanted the content to be called up:

<?php 
$pageDir = $_SERVER['DOCUMENT_ROOT'].'/home/planetma/public_html/'; 
if(basename($_GET['page']) != $_GET['page'] or !file_exists($pageDir.$_GET['page'])) 
{ 
   header("HTTP/1.0 404 Not Found"); 
   exit; 
} 
?> 

I got an error concerning the header, so I deleted that part, it still didn't work. I also tried putting the above code in members.php at the top, then using

<?php include("$page"); ?>

that code in the layout.php file where I wanted to members.php content to load, and that didn't work either.
Btw, thanks for the help so far, it's much appreciated.

[Mado]

Maybe it would help if you could explain to me exactly what the code you wrote does? I mean, if there's a $ in front of something, that means its a variable, correct? And doesn't the variable need to be defined before calling it?
Like in your example

if ($_REQUEST['page'] == 'home') 
{ 
    require 'pages/home.php'; 
} 

$_REQUEST isn't defined, correct? Or is it a predefined variable already included in any php code that is written? Either way, how exaclty would I use that code/place that code for the following url http://www.planetmado.com/layout.php?page=members.php to call up the content (members.php) included in the layout (layout.php) ?

[foyer]

Maybe it would help me if you could explain what the code you wrote does lol 😉

First of all, http://us2.php.net/reserved.variables

It's a predefined variable, it is the same as using $GET or $POST. Honestly, I really think your understanding of PHP is a bit off, and I'm not criticizing you but I would encourage you to start to learn it from the top. It's not difficult and I bet you would understand the script you posted in less than a day of research. There are loads of articles on this site that will help you.

[Mado]

Okay, point taken🙂 I've googled some websites on learning php, some of it helped a bit, but most of it wasn't written very well. I'll read some articles on this site and see what I can learn. I would agree with you that my understanding of php is a bit off. Like I said before, thanks for the help so far.