Reply to thread

Message

<blockquote data-quote="sudu hawa" data-source="post: 12019612" data-attributes="member: 382989">machanla mata me code eka&nbsp; piliwelata hadala onne mata one message eka vitharai anithe awa wadak na$to = 'info@gmail.com';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $subject = 'HACK ATTEMPT';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $header = 'From: <a href="mailto:cinamapark@gmail.com">info@gmail.com</a>';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (mail($to, $subject, $logging, $header)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;Sent notice to admin.&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; function verifyFormToken($form) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // check if a session is started and a token is transmitted, if not return an error&nbsp; &nbsp; &nbsp; &nbsp; if(!isset($_SESSION[$form.'_token'])) { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return false;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // check if the form is sent with token in it&nbsp; &nbsp; &nbsp; &nbsp; if(!isset($_POST['token'])) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return false;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // compare the tokens against each other if they are still the same&nbsp; &nbsp; &nbsp; &nbsp; if ($_SESSION[$form.'_token'] !== $_POST['token']) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return false;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return true;&nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; function generateFormToken($form) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // generate a token from an unique value, took from microtime, you can also use salt-values, other crypting methods...&nbsp; &nbsp; &nbsp; &nbsp; $token = md5(uniqid(microtime(), true));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Write the generated token to the session variable to check it against the hidden field when the form is sent&nbsp; &nbsp; &nbsp; &nbsp; $_SESSION[$form.'_token'] = $token; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return $token;&nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; // VERIFY LEGITIMACY OF TOKEN&nbsp; &nbsp; if (verifyFormToken('form1')) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // CHECK TO SEE IF THIS IS A MAIL POST&nbsp; &nbsp; &nbsp; &nbsp; if (isset($_POST['URL-main'])) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Building a whitelist array with keys which will send through the form, no others would be accepted later on&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $whitelist = array('token','req-name','req-email','typeOfChange','urgency','URL-main','addURLS', 'curText', 'newText', 'save-stuff', 'mult');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Building an array with the $_POST-superglobal &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; foreach ($_POST as $key=&gt;$item) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Check if the value $key (fieldname from $_POST) can be found in the whitelisting array, if not, die with a short message to the hacker&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (!in_array($key, $whitelist)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; writeLog('Unknown form fields');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; die(&quot;Hack-Attempt detected. Please use only the fields in the form&quot;);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // PREPARE THE BODY OF THE MESSAGE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message = '&lt;html&gt;&lt;body&gt;';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= '&lt;img src=&quot;http://css-tricks.com/examples/WebsiteChangeRequestForm/images/wcrf-header.png&quot; alt=&quot;Website Change Request&quot; /&gt;';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= '&lt;table rules=&quot;all&quot; style=&quot;border-color: #666;&quot; cellpadding=&quot;10&quot;&gt;';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;tr style='background: #eee;'&gt;&lt;td&gt;&lt;strong&gt;Name:&lt;/strong&gt; &lt;/td&gt;&lt;td&gt;&quot; . strip_tags($_POST['txtna']) . &quot;&lt;/td&gt;&lt;/tr&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;tr&gt;&lt;td&gt;&lt;strong&gt;Email:&lt;/strong&gt; &lt;/td&gt;&lt;td&gt;&quot; . strip_tags($_POST['req-email']) . &quot;&lt;/td&gt;&lt;/tr&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;tr&gt;&lt;td&gt;&lt;strong&gt;Type of Change:&lt;/strong&gt; &lt;/td&gt;&lt;td&gt;&quot; . strip_tags($_POST['typeOfChange']) . &quot;&lt;/td&gt;&lt;/tr&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;tr&gt;&lt;td&gt;&lt;strong&gt;Urgency:&lt;/strong&gt; &lt;/td&gt;&lt;td&gt;&quot; . strip_tags($_POST['urgency']) . &quot;&lt;/td&gt;&lt;/tr&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;tr&gt;&lt;td&gt;&lt;strong&gt;URL To Change (main):&lt;/strong&gt; &lt;/td&gt;&lt;td&gt;&quot; . $_POST['URL-main'] . &quot;&lt;/td&gt;&lt;/tr&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $addURLS = $_POST['addURLS'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (($addURLS) != '') {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;tr&gt;&lt;td&gt;&lt;strong&gt;URL To Change (additional):&lt;/strong&gt; &lt;/td&gt;&lt;td&gt;&quot; . strip_tags($addURLS) . &quot;&lt;/td&gt;&lt;/tr&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $curText = htmlentities($_POST['curText']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (($curText) != '') {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;tr&gt;&lt;td&gt;&lt;strong&gt;CURRENT Content:&lt;/strong&gt; &lt;/td&gt;&lt;td&gt;&quot; . $curText . &quot;&lt;/td&gt;&lt;/tr&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;tr&gt;&lt;td&gt;&lt;strong&gt;NEW Content:&lt;/strong&gt; &lt;/td&gt;&lt;td&gt;&quot; . htmlentities($_POST['newText']) . &quot;&lt;/td&gt;&lt;/tr&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;/table&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $message .= &quot;&lt;/body&gt;&lt;/html&gt;&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //&nbsp; MAKE SURE THE &quot;FROM&quot; EMAIL ADDRESS DOESN'T HAVE ANY NASTY STUFF IN IT&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $pattern = &quot;/^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$/i&quot;; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (preg_match($pattern, trim(strip_tags($_POST['req-email'])))) { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $cleanedFrom = trim(strip_tags($_POST['req-email'])); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } else { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return &quot;The email address you entered was invalid. Please try again!&quot;; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //&nbsp;&nbsp; CHANGE THE BELOW VARIABLES TO YOUR NEEDS&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $to = 'info@gmail.com';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $subject = 'Website Change Reqest';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $headers = &quot;From: &quot; . $cleanedFrom . &quot;\r\n&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $headers .= &quot;Reply-To: &quot;. strip_tags($_POST['req-email']) . &quot;\r\n&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $headers .= &quot;MIME-Version: 1.0\r\n&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $headers .= &quot;Content-Type: text/html; charset=ISO-8859-1\r\n&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (mail($to, $subject, $message, $headers)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo 'Your message has been sent.';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo 'There was a problem sending the email.';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // DON'T BOTHER CONTINUING TO THE HTML...&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; die();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; if (!isset($_SESSION[$form.'_token'])) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; echo &quot;Hack-Attempt detected. Got ya!.&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; writeLog('Formtoken');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; }&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; }?&gt;</blockquote>

[QUOTE="sudu hawa, post: 12019612, member: 382989"] machanla mata me code eka piliwelata hadala onne mata one message eka vitharai anithe awa wadak na $to = 'info@gmail.com'; $subject = 'HACK ATTEMPT'; $header = 'From: [EMAIL="cinamapark@gmail.com"]info@gmail.com[/EMAIL]'; if (mail($to, $subject, $logging, $header)) { echo "Sent notice to admin."; } } function verifyFormToken($form) { // check if a session is started and a token is transmitted, if not return an error if(!isset($_SESSION[$form.'_token'])) { return false; } // check if the form is sent with token in it if(!isset($_POST['token'])) { return false; } // compare the tokens against each other if they are still the same if ($_SESSION[$form.'_token'] !== $_POST['token']) { return false; } return true; } function generateFormToken($form) { // generate a token from an unique value, took from microtime, you can also use salt-values, other crypting methods... $token = md5(uniqid(microtime(), true)); // Write the generated token to the session variable to check it against the hidden field when the form is sent $_SESSION[$form.'_token'] = $token; return $token; } // VERIFY LEGITIMACY OF TOKEN if (verifyFormToken('form1')) { // CHECK TO SEE IF THIS IS A MAIL POST if (isset($_POST['URL-main'])) { // Building a whitelist array with keys which will send through the form, no others would be accepted later on $whitelist = array('token','req-name','req-email','typeOfChange','urgency','URL-main','addURLS', 'curText', 'newText', 'save-stuff', 'mult'); // Building an array with the $_POST-superglobal foreach ($_POST as $key=>$item) { // Check if the value $key (fieldname from $_POST) can be found in the whitelisting array, if not, die with a short message to the hacker if (!in_array($key, $whitelist)) { writeLog('Unknown form fields'); die("Hack-Attempt detected. Please use only the fields in the form"); } // PREPARE THE BODY OF THE MESSAGE $message = '<html><body>'; $message .= '<img src="http://css-tricks.com/examples/WebsiteChangeRequestForm/images/wcrf-header.png" alt="Website Change Request" />'; $message .= '<table rules="all" style="border-color: #666;" cellpadding="10">'; $message .= "<tr style='background: #eee;'><td>Name: </td><td>" . strip_tags($_POST['txtna']) . "</td></tr>"; $message .= "<tr><td>Email: </td><td>" . strip_tags($_POST['req-email']) . "</td></tr>"; $message .= "<tr><td>Type of Change: </td><td>" . strip_tags($_POST['typeOfChange']) . "</td></tr>"; $message .= "<tr><td>Urgency: </td><td>" . strip_tags($_POST['urgency']) . "</td></tr>"; $message .= "<tr><td>URL To Change (main): </td><td>" . $_POST['URL-main'] . "</td></tr>"; $addURLS = $_POST['addURLS']; if (($addURLS) != '') { $message .= "<tr><td>URL To Change (additional): </td><td>" . strip_tags($addURLS) . "</td></tr>"; } $curText = htmlentities($_POST['curText']); if (($curText) != '') { $message .= "<tr><td>CURRENT Content: </td><td>" . $curText . "</td></tr>"; } $message .= "<tr><td>NEW Content: </td><td>" . htmlentities($_POST['newText']) . "</td></tr>"; $message .= "</table>"; $message .= "</body></html>"; // MAKE SURE THE "FROM" EMAIL ADDRESS DOESN'T HAVE ANY NASTY STUFF IN IT $pattern = "/^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$/i"; if (preg_match($pattern, trim(strip_tags($_POST['req-email'])))) { $cleanedFrom = trim(strip_tags($_POST['req-email'])); } else { return "The email address you entered was invalid. Please try again!"; } // CHANGE THE BELOW VARIABLES TO YOUR NEEDS $to = 'info@gmail.com'; $subject = 'Website Change Reqest'; $headers = "From: " . $cleanedFrom . "\r\n"; $headers .= "Reply-To: ". strip_tags($_POST['req-email']) . "\r\n"; $headers .= "MIME-Version: 1.0\r\n"; $headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n"; if (mail($to, $subject, $message, $headers)) { echo 'Your message has been sent.'; } else { echo 'There was a problem sending the email.'; } // DON'T BOTHER CONTINUING TO THE HTML... die(); } } else { if (!isset($_SESSION[$form.'_token'])) { } else { echo "Hack-Attempt detected. Got ya!."; writeLog('Formtoken'); } } ?> [/QUOTE]

Verification

Dahaya deken beduwama keeyada?

Search

Latest ads

Reply to thread