Security van mijn php bestanden. - Forum

Erwin Augustijn

05-09-2012 15:06


<?php
$inlog=mysql_real_escape_string($_POST['inlog']);
$ww=mysql_real_escape_string($_POST['wachtwoord']);
$resultaat='';
$actief='';
$redeninactief='';
$datum=mysql_real_escape_string(date("d-m-Y"));
$tijd=mysql_real_escape_string(date("H:i:s"));
$ip=mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
$opmerking='Registreer of log met juiste gegevens in.';

include('****');

$result = mysql_query("SELECT * FROM users WHERE inlog ='$inlog' and
wachtwoord  = '$ww' ");
while ($row = mysql_fetch_assoc($result)) {
$opmerking='';
$resultaat='oke';
$actief=$row['actief'];
$redeninactief=$row['redeninactief'];
$klas=$row['klas'];

}
mysql_query("INSERT INTO login (speler, datum, tijd, ip) VALUES
 ('$inlog', '$datum', '$tijd', '$ip')");

echo "&resultaat=".$resultaat."&";
echo "&wachtwoord=&";
echo "&opmerking1=".$opmerking."&";
echo "&actief=".$actief."&";
echo "&opmtekst=".$redeninactief."&";
echo "&opmtitel=Oeps daar ging iets fout !&";
echo "&klas=".$klas."&";
echo "&script=klaar&";

mysql_close($link);

?>

Op bovenstaande manier voorkom je al MySQL-injectie.
Verder is het aan te raden om de output ook te escapen via htmlspecialchars() of htmlentities(), bijv.:


echo "&resultaat=".htmlentities($resultaat)."&";

Write Down

05-09-2012 15:08

Doe die 'aangeraden' maar weg. Anders post ik gelijk een Javascriptje

K

Kevin De Ras

05-09-2012 15:10

Ok bedankt al voor jullie tips.
Nog een vraagje,
ik zou graag hebben dat dit enkel opgeroepen kan worden door mijn swf bestand.

Is dit mogelijk ?

Alvast bedankt!

Ariën

05-09-2012 15:14

Even wat punten, die niet alleen over de veiligheid gaan:

1) variabelen buiten quotes.
2) Zorg voor goede foutafhandeling op je mysql_query, met if- en else.
3) Zorg dat je met sha1() je wachtwoord encrypt, en dan het liefste met een salt vooraf, waarin een top-secret code staat.
4) Sla liever niet zoals Erwin doet de escaped waardes (zijn lijn 1,4,7,8, en 9) in een andere variabele op. Zo kan je het overzicht kwijtraken of je het daadwerkelijk ge-escaped hebt, zo niet dan kan dat fataal zijn voor je site, maar pas deze functie toe in je query.

Kris Peeters

05-09-2012 16:02

Dus, het belangrijkste wat je hoort te doen, is query's maken op zo'n manier (wat betreft het beschermen van die post variabele):

<?php
$result = mysql_query("SELECT * FROM users WHERE inlog ='" . mysql_real_escape_string($_POST['inlog']) . "'";
?>

S

Stefan WM

05-09-2012 16:09

Ik zou een salt gebruiken, daarnaast zou ik een hash in de DB opslaan en niet het wachtwoord zelf. Mocht er ooit iets gehackt worden heb je een versleutelde hash in je DB staan en niet het wachtwoord. Bij het inloggen controlleer je op de hash

K

Kevin De Ras

08-09-2012 17:21

1 probleempje, hoe kan een persoon dan zijn wachtwoord opvragen ?

Ozzie PHP

08-09-2012 18:10

Dat kan niet. Als hij z'n wachtwoord is vergeten, dan moet hij een nieuw wachtwoord aanmaken.

K

Kevin De Ras

08-09-2012 19:27

En ik heb nog een probleem met dit script :
het zegt wel dat de mail verzonden is maar er komt wel nooit een mail toe ?!
<?php
$mail=$_POST['email'];
include('**************');

$result = mysql_query("SELECT * FROM users WHERE mail ='$mail' ");
while ($row = mysql_fetch_assoc($result)) {
$inlog=$row['inlog'];
$wachtwoord=$row['wachtwoord'];
$opmerking='Een mail is verstuurd naar het email adres. Vergeet niet alle postvakken en ook spam te bekijken.';
$gevonden='ja';
}
if ($gevonden=='ja'){
//define the receiver of the email
//define the receiver of the email
$to = $mail;

//define the subject of the email
$subject = 'Uw wachtwoord vergeten';
//define the message to be sent. Each line should be separated with \n
$message = '<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional //EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head>;
<meta http-equiv="Content-Language" content="nl-be">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><style type="text/css">
/* Mobile-specific Styles */
@media only screen and (max-device-width: 480px) {
table[class=w0], td[class=w0] { width: 0 !important; }
table[class=w10], td[class=w10], img[class=w10] { width:10px !important; }
table[class=w15], td[class=w15], img[class=w15] { width:5px !important; }
table[class=w30], td[class=w30], img[class=w30] { width:10px !important; }
table[class=w60], td[class=w60], img[class=w60] { width:10px !important; }
table[class=w125], td[class=w125], img[class=w125] { width:80px !important; }
table[class=w130], td[class=w130], img[class=w130] { width:55px !important; }
table[class=w140], td[class=w140], img[class=w140] { width:90px !important; }
table[class=w160], td[class=w160], img[class=w160] { width:180px !important; }
table[class=w170], td[class=w170], img[class=w170] { width:100px !important; }
table[class=w180], td[class=w180], img[class=w180] { width:80px !important; }
table[class=w195], td[class=w195], img[class=w195] { width:80px !important; }
table[class=w220], td[class=w220], img[class=w220] { width:80px !important; }
table[class=w240], td[class=w240], img[class=w240] { width:180px !important; }
table[class=w255], td[class=w255], img[class=w255] { width:185px !important; }
table[class=w275], td[class=w275], img[class=w275] { width:135px !important; }
table[class=w280], td[class=w280], img[class=w280] { width:135px !important; }
table[class=w300], td[class=w300], img[class=w300] { width:140px !important; }
table[class=w325], td[class=w325], img[class=w325] { width:95px !important; }
table[class=w360], td[class=w360], img[class=w360] { width:140px !important; }
table[class=w410], td[class=w410], img[class=w410] { width:180px !important; }
table[class=w470], td[class=w470], img[class=w470] { width:200px !important; }
table[class=w580], td[class=w580], img[class=w580] { width:280px !important; }
table[class=w640], td[class=w640], img[class=w640] { width:300px !important; }
table[class*=hide], td[class*=hide], img[class*=hide], p[class*=hide], span[class*=hide] { display:none !important; }
table[class=h0], td[class=h0] { height: 0 !important; }
p[class=footer-content-left] { text-align: center !important; }
#headline p { font-size: 30px !important; }
.article-content, #left-sidebar{ -webkit-text-size-adjust: 90% !important; -ms-text-size-adjust: 90% !important; }
.header-content, .footer-content-left {-webkit-text-size-adjust: 80% !important; -ms-text-size-adjust: 80% !important;}
}
/* Client-specific Styles */
#outlook a { padding: 0; } /* Force Outlook to provide a "view in browser" button. */
body { width: 100% !important; }
.ReadMsgBody { width: 100%; }
.ExternalClass { width: 100%; display:block !important; } /* Force Hotmail to display emails at full width */
html, body { background-color: #ececec; margin: 0; padding: 0; }
img { height: auto; line-height: 100%; outline: none; text-decoration: none; display: block;}
br, strong br, b br, em br, i br { line-height:100%; }
h1, h2, h3, h4, h5, h6 { line-height: 100% !important; -webkit-font-smoothing: antialiased; }
h1 a, h2 a, h3 a, h4 a, h5 a, h6 a { color: blue !important; }
h1 a:active, h2 a:active, h3 a:active, h4 a:active, h5 a:active, h6 a:active { color: red !important; }
/* Preferably not the same color as the normal header link color. There is limited support for psuedo classes in email clients, this was added just for good measure. */
h1 a:visited, h2 a:visited, h3 a:visited, h4 a:visited, h5 a:visited, h6 a:visited { color: purple !important; }
/* Preferably not the same color as the normal header link color. There is limited support for psuedo classes in email clients, this was added just for good measure. */
table td, table tr { border-collapse: collapse; }
.yshortcuts, .yshortcuts a, .yshortcuts a:link,.yshortcuts a:visited, .yshortcuts a:hover, .yshortcuts a span {
color: black; text-decoration: none !important; border-bottom: none !important; background: none !important;
}
code {
white-space: normal;
word-break: break-all;
}
#background-table { background-color: #ececec; }
#top-bar { border-radius:6px 6px 0px 0px; -moz-border-radius: 6px 6px 0px 0px; -webkit-border-radius:6px 6px 0px 0px; -webkit-font-smoothing: antialiased; background-color: #4b4044; color: #72a6a6; }
#top-bar a { font-weight: bold; color: #72a6a6; text-decoration: none;}
#footer { border-radius:0px 0px 6px 6px; -moz-border-radius: 0px 0px 6px 6px; -webkit-border-radius:0px 0px 6px 6px; -webkit-font-smoothing: antialiased; }
body, td { font-family: Helvetica Neue, Arial, Helvetica, Geneva, sans-serif; }
.header-content, .footer-content-left, .footer-content-right { -webkit-text-size-adjust: none; -ms-text-size-adjust: none; }
.header-content { font-size: 12px; color: #72a6a6; }
.header-content a { font-weight: bold; color: #72a6a6; text-decoration: none; }
#headline p { color: #72a6a6; font-family: Helvetica Neue, Arial, Helvetica, Geneva, sans-serif; font-size: 36px; text-align: center; margin-top:0px; margin-bottom:30px; }
#headline p a { color: #72a6a6; text-decoration: none; }
.article-title { font-size: 18px; line-height:24px; color: #d9653b; font-weight:bold; margin-top:0px; margin-bottom:18px; font-family: Helvetica Neue, Arial, Helvetica, Geneva, sans-serif; }
.article-title a { color: #d9653b; text-decoration: none; }
.article-title.with-meta {margin-bottom: 0;}
.article-meta { font-size: 13px; line-height: 20px; color: #ccc; font-weight: bold; margin-top: 0;}
.article-content { font-size: 13px; line-height: 18px; color: #444444; margin-top: 0px; margin-bottom: 18px; font-family: Helvetica Neue, Arial, Helvetica, Geneva, sans-serif; }
.article-content a { color: #7f8c4f; font-weight:bold; text-decoration:none; }
.article-content img { max-width: 100% }
.article-content ol, .article-content ul { margin-top:0px; margin-bottom:18px; margin-left:19px; padding:0; }
.article-content li { font-size: 13px; line-height: 18px; color: #444444; }
.article-content li a { color: #7f8c4f; text-decoration:underline; }
.article-content p {margin-bottom: 15px;}
.footer-content-left { font-size: 12px; line-height: 15px; color: #72a6a6; margin-top: 0px; margin-bottom: 15px; }
.footer-content-left a { color: #d5e9e7; font-weight: bold; text-decoration: none; }
.footer-content-right { font-size: 11px; line-height: 16px; color: #72a6a6; margin-top: 0px; margin-bottom: 15px; }
.footer-content-right a { color: #d5e9e7; font-weight: bold; text-decoration: none; }
#footer { background-color: #4b4c44; color: #72a6a6; }
#footer a { color: #d5e9e7; text-decoration: none; font-weight: bold; }
#permission-reminder { white-space: normal; }
#street-address { color: #d5e9e7; white-space: normal; }
</style>
</head><body><table width="100%" cellpadding="0" cellspacing="0" border="0" id="background-table">
<tbody><tr>
<td align="center" bgcolor="#ececec">
<table class="w640" style="margin:0 10px;" width="640" cellpadding="0" cellspacing="0" border="0">
<tbody><tr><td class="w640" width="640" height="20"></td></tr>

<tr>
<td class="w640" width="640">
<table id="top-bar" class="w640" width="640" cellpadding="0" cellspacing="0" border="0" bgcolor="#d5e9e7">
<tbody><tr>
<td class="w15" width="15"></td>
<td class="w325" width="350" valign="middle" align="left">
<table class="w325" width="350" cellpadding="0" cellspacing="0" border="0">
<tbody><tr><td class="w325" width="350" height="8"></td></tr>
</tbody></table>
<div class="header-content"> </div>
<table class="w325" width="350" cellpadding="0" cellspacing="0" border="0">
<tbody><tr><td class="w325" width="350" height="8"></td></tr>
</tbody></table>
</td>
<td class="w30" width="30"></td>
<td class="w255" width="255" valign="middle" align="right">
<table class="w255" width="255" cellpadding="0" cellspacing="0" border="0">
<tbody><tr><td class="w255" width="255" height="8"></td></tr>
</tbody></table>
<table class="w255" width="255" cellpadding="0" cellspacing="0" border="0">
<tbody><tr><td class="w255" width="255" height="8"></td></tr>
</tbody></table>
</td>
<td class="w15" width="15"></td>
</tr>
</tbody></table>

</td>
</tr>
<tr>
<td id="header" class="w640" width="640" align="center" bgcolor="#d5e9e7">

<table class="w640" width="640" cellpadding="0" cellspacing="0" border="0">
<tbody><tr><td class="w30" width="30"></td><td class="w580" width="580" height="30"></td><td class="w30" width="30"></td></tr>
<tr>
<td class="w30" width="30"></td>
<td class="w580" width="580"><div align="center" id="headline"><p><strong>
georefresh</strong></p></div></td>
<td class="w30" width="30"></td>
</tr>
</tbody></table>

</td>
</tr>

<tr><td class="w640" width="640" height="30" bgcolor="#ffffff"></td></tr>
<tr id="simple-content-row"><td class="w640" width="640" bgcolor="#ffffff">
<table class="w640" width="640" cellpadding="0" cellspacing="0" border="0">
<tbody><tr>
<td class="w30" width="30"></td>
<td class="w580" width="580">
<repeater>

<layout label="Text only">
<table class="w580" width="580" cellpadding="0" cellspacing="0" border="0">
<tbody><tr>
<td class="w580" width="580">
<p align="left" class="article-title">
Aanvraag wachtwoord georefresh</p>
<div align="left" class="article-content">
Via onze website heb je je gegevens op gevraagd.
<br>
Hebt u deze gegevens niet opgevraagd? 
<br>
Verwijder dan gewoon deze mail.
<p> Uw gegevens om in te loggen zijn :</p>
<p>Gebruikersnaam : <b>'.$inlog.'</b><br>
Wachtwoord : <b>'.$wachtwoord.'</b><br>
<br>
 </p>
<p>Veel succes bij het oefenen!</div>
</td>
</tr>
<tr><td class="w580" width="580" height="10"></td></tr>
</tbody></table>
</layout>

<layout label="Text with left-aligned image">
<table class="w580" width="580" cellpadding="0" cellspacing="0" border="0">
<tbody>
<tr><td class="w580" width="580" height="10"></td></tr>
</tbody></table>
</layout>

</repeater>
</td>
<td class="w30" width="30"></td>
</tr>
</tbody></table>
</td></tr>
<tr><td class="w640" width="640" height="15" bgcolor="#ffffff"></td></tr>

<tr>
<td class="w640" width="640">
<table id="footer" class="w640" width="640" cellpadding="0" cellspacing="0" border="0" bgcolor="#4b4c44">
<tbody><tr><td class="w30" width="30"></td>
<td class="w580 h0" width="360" height="18"></td><td class="w0" width="60"></td><td class="w0" width="160"></td><td class="w30" width="30"></td></tr>
<tr>
<td class="w30" width="30"></td>
<td class="w580" width="360" valign="top">
<span class="hide"><p id="permission-reminder" align="left" class="footer-content-left"></p></span>
<p align="left" class="footer-content-left">
<a href="http://www.georefresh.be">www.georefresh.be</a></p>;
</td>
<td class="hide w0" width="60"></td>
<td class="hide w0" width="160" valign="top">
<p id="street-address" align="right" class="footer-content-right"></p>
</td>
<td class="w30" width="30"></td>
</tr>
<tr><td class="w30" width="30"></td><td class="w580 h0" width="360" height="15"></td><td class="w0" width="60"></td><td class="w0" width="160"></td><td class="w30" width="30"></td></tr>
</tbody></table>
</td>
</tr>
<tr><td class="w640" width="640" height="147"></td></tr>
</tbody></table>
</td>
</tr>
</tbody></table></body></html>';

$headers = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
$headers .= "From: [email protected]\r\nReply-To: [email protected]";
//send the email
$mail_sent = @mail( $to, $subject, $message, $headers );
//if the message is sent successfully print "Mail sent". Otherwise print "Mail failed"
echo $mail_sent ? "Mail sent" : "Mail failed";}
else {
$opmerking="Er is een probleem opgetreden, het opgegeven e-mail adres is niet gevonden.";
}
echo "&opmerking=".$opmerking."&";
echo "&gevonden=".$gevonden."&";
echo "&script=klaar&";
echo "&mail=".$mail."&";
echo "&script=klaar&";
mysql_close($link);

?>

Eddy E

09-09-2012 10:19

Haal die @ is weg.
En kijk naar het resultaat ($mail_sent) of hij verzonden is.
Maar als er een foutmelding is, dan zie je die niet (door de @).