mata one page ekaka video embed(window media player plugin eka) ekaka play wena video eka pahala tiyena video files wla links click kalama adala video eka play karanna puluwan script ekak. eka ekama page eke idan karanna puluwan ekak wenna ona.
<?php
$db_handle = mysql_connect($server, $user_name, $password);
$db_found = mysql_select_db($database, $db_handle);
if ($db_found)
{
$video=$_GET[video];
$SQL = "SELECT `videosub`.* FROM videosub WHERE (`videosub`.`vid` ='$video'))";
$result = mysql_query($SQL);
if ($result)
{
$playfile=$result['file_url'];
}
mysql_close($db_handle);
}
else
{
print "Database NOT Found ";
mysql_close($db_handle);
}
?><html>
<head>
</head>
<body>
<OBJECT ID="MediaPlayer" WIDTH="400" HEIGHT="389" CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95"
STANDBY="Loading" TYPE="application/x-oleobject">
<PARAM NAME="FileName" VALUE="[B][COLOR="Red"]<?php print($playfile);?>[/COLOR][/B]">
<PARAM name="autostart" VALUE="false">
<PARAM name="ShowControls" VALUE="true">
<param name="ShowStatusBar" value="false">
<PARAM name="ShowDisplay" VALUE="false">
<EMBED TYPE="application/x-mplayer2" SRC="[B][COLOR="red"]<?php print($playfile);?>[/COLOR][/B]" NAME="MediaPlayer"
WIDTH="400" HEIGHT="389" ShowControls="1" ShowStatusBar="0" ShowDisplay="0" autostart="0"> </EMBED>
</OBJECT>
<br>
[U]<p><a href="video.php?video=1">Video 1</a></p>
<p><a href="video.php?video=2">Video 2 </a></p>
<p><a href="video.php?video=3">Video 3 </a></p>[/U]
</body>
</html>
<?php
$vidID = ( isset($_GET['video']) && is_numeric($_GET['video']) ) ? $_GET['video'] : '';
?>
<html>
<head></head>
<body>
<?php
if ($vidID != '') {
$playfile = 'PATH TO THE FILE'.$vidID.'.EXTENTION';
# Example
# if file name of the file is song1.mp3 , it will go like following
# $playfile = 'files/mp3/song'.$vidID.'.mp3';
# 1 = file ID
?>
<OBJECT ID="MediaPlayer" WIDTH="400" HEIGHT="389" CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95"
STANDBY="Loading" TYPE="application/x-oleobject">
<PARAM NAME="FileName" VALUE="<?php echo($playfile);?>">
<PARAM name="autostart" VALUE="false">
<PARAM name="ShowControls" VALUE="true">
<param name="ShowStatusBar" value="false">
<PARAM name="ShowDisplay" VALUE="false">
<EMBED TYPE="application/x-mplayer2" SRC="<?php echo($playfile);?>" NAME="MediaPlayer"
WIDTH="400" HEIGHT="389" ShowControls="1" ShowStatusBar="0" ShowDisplay="0" autostart="0"> </EMBED>
</OBJECT>
<br />
<?php
} else {
echo "INVALID FILE NAME SPECIFIED.<br />Please Try Again!";
}
?>
<p><a href="video.php?video=1">Video 1</a></p>
<p><a href="video.php?video=2">Video 2 </a></p>
<p><a href="video.php?video=3">Video 3 </a></p>
</body>
</html>
machan oyage code eka weda karanawa.. habai e code eka secutrity athi nam godak durvalai. SQL INJECTION ekak gahanna puluwan lesiyenmaPHP:<?php $db_handle = mysql_connect($server, $user_name, $password); $db_found = mysql_select_db($database, $db_handle); if ($db_found) { $video=$_GET[video]; $SQL = "SELECT `videosub`.* FROM videosub WHERE (`videosub`.`vid` ='$video'))"; $result = mysql_query($SQL); if ($result) { $playfile=$result['file_url']; } mysql_close($db_handle); } else { print "Database NOT Found "; mysql_close($db_handle); } ?>
Code:<html> <head> </head> <body> <OBJECT ID="MediaPlayer" WIDTH="400" HEIGHT="389" CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95" STANDBY="Loading" TYPE="application/x-oleobject"> <PARAM NAME="FileName" VALUE="[B][COLOR="Red"]<?php print($playfile);?>[/COLOR][/B]"> <PARAM name="autostart" VALUE="false"> <PARAM name="ShowControls" VALUE="true"> <param name="ShowStatusBar" value="false"> <PARAM name="ShowDisplay" VALUE="false"> <EMBED TYPE="application/x-mplayer2" SRC="[B][COLOR="red"]<?php print($playfile);?>[/COLOR][/B]" NAME="MediaPlayer" WIDTH="400" HEIGHT="389" ShowControls="1" ShowStatusBar="0" ShowDisplay="0" autostart="0"> </EMBED> </OBJECT> <br> [U]<p><a href="video.php?video=1">Video 1</a></p> <p><a href="video.php?video=2">Video 2 </a></p> <p><a href="video.php?video=3">Video 3 </a></p>[/U] </body> </html>
CODE EXPLANATION
Using the links we pass the value
Then using above php code we retrieve the value which is passed using the url (ie $_GET[video]=2]
We use that value to extract a file url from the database
Once the file url is retrieved we assign that value to a variable then use that variable in the wmv playersfile url code to view the video
thats all !!!
[COLOR=#000000][COLOR=#0000BB]$video[/COLOR][COLOR=#007700]=[/COLOR][COLOR=#0000BB]$_GET[/COLOR][COLOR=#007700][[/COLOR][COLOR=#0000BB]video[/COLOR][COLOR=#007700]]; [/COLOR][/COLOR]machan oyage code eka weda karanawa.. habai e code eka secutrity athi nam godak durvalai. SQL INJECTION ekak gahanna puluwan lesiyenma
Code:[COLOR=#000000][COLOR=#0000BB]$video[/COLOR][COLOR=#007700]=[/COLOR][COLOR=#0000BB]$_GET[/COLOR][COLOR=#007700][[/COLOR][COLOR=#0000BB]video[/COLOR][COLOR=#007700]]; [/COLOR][/COLOR]
othanadi kisima security check kirimak wenne na.
<?php
$video = $_GET['video'];
$video = (int) $video;
if($video>0)
{
#dbcode
}
?>
yea bro thats correct this piece of code can be easily sql injected !!
the code below will check weather the value passed is integer if any other character other than numbers are passed then the variable video will be 0 then after that we check with a if condition whether the variable has a value which is greater than 0!!
hope now the security problem is okPHP:<?php $video = $_GET['video']; $video = (int) $video; if($video>0) { #dbcode } ?>
for more security URL REWRITE is good !!!
<?php
$video = (isset($_GET['video'])) ? $_GET['video'] : '';
if( (is_numeric($video)) && ($video>0) )
{
#dbcode
}
?>This will do that process better
PHP:<?php $video = (isset($_GET['video'])) ? $_GET['video'] : ''; if( (is_numeric($video)) && ($video>0) ) { #dbcode } ?>
eke ithin PHP sambandayak naa ne.. JavaScript eken ne stream select wenne. JavaSripts disable nam radio eka weda na
eke ithin PHP sambandayak naa ne.. JavaScript eken ne stream select wenne. JavaSripts disable nam radio eka weda na
BTW - DO NOT SPAM
PS:- [Powered By Sandakelum Encryption Technology ]
dan oke monawada encrypt karala thiyenne
hari hari
