even offline

Status
Not open for further replies.

stefkee3

New Member
Messages
13
Reaction score
0
Points
0
il have made a database at x10hosting and if i chance it in gegevens.php do i don't have to change the sitelink?
 
Last edited:

galaxyAbstractor

Community Advocate
Community Support
Messages
5,508
Reaction score
35
Points
48
PHP:
$user        =    "mygaming_corlet";
should be
PHP:
$user        =    "stefkee3_corlet";

PHP:
$tablename    =    "mygaming_gangster";
should be
PHP:
$tablename    =    "stefkee3_gangster";
// I assume the author of the script means database name
 

stefkee3

New Member
Messages
13
Reaction score
0
Points
0
il just copy it and it doesn't work!
but, even thank you for the backup;)
Edit:
so?, anywone els a sugestion?
Edit:
ah comon people ther must be somewone who know's this?
 
Last edited:

galaxyAbstractor

Community Advocate
Community Support
Messages
5,508
Reaction score
35
Points
48
Your site seems working now, but you are including the files wrong. I think it should be

PHP:
include(config2.php);

instead of

PHP:
include(_include-config2.php);
 
Last edited:

misson

Community Paragon
Community Support
Messages
2,572
Reaction score
72
Points
48
il have made a database at x10hosting and if i chance it in gegevens.php do i don't have to change the sitelink?
$sitelink doesn't look to be involved with the database at all. It looks like it's used when referring to other resources (e.g. stylesheets and other pages). You should change it so that links don't refer to resources off-site.


Edit:
so?, anywone els a sugestion?
Edit:
ah comon people ther must be somewone who know's this?
Only if you keep us up-to-date on what problem you're having and what you've done in trying to solve it.


PHP:
include(config2.php);
...
PHP:
include(_include-config2.php);

Don't neglect to quote the script names:
PHP:
include('_include-config2.php');



index.php
PHP:
...
mysql_query("UPDATE `[users]` SET `camera`=`camera`+'2' WHERE `ctype`='1'");
mysql_query("UPDATE `[users]` SET `shotgun`=`shotgun`+'2' WHERE `ctype`='2'");
mysql_query("UPDATE `[users]` SET `camera`=`camera`+'2' WHERE `ctype`='3'");
mysql_query("UPDATE `[users]` SET `shotgun`=`shotgun`+'2' WHERE `ctype`='4'");
...
This long sequence of queries can be replaced with just two:
PHP:
mysql_query("UPDATE `[users]` SET `camera`=`camera`+2 WHERE `ctype` % 2");
mysql_query("UPDATE `[users]` SET `shotgun`=`shotgun`+2 WHERE (`ctype` % 2) = 0");


The posted code (index.php &c.) has massive SQL injection vulnerabilities. You have two potential solutions:
  1. use the quote_smart function defined in _include-config2.php everywhere you get data that will end up in an SQL statement from a relevant superglobal (e.g. $_GET, $_POST). For example, in index.php change:
    PHP:
    if(isset($_POST['login'],$_POST['pass'])) {
    $dbres = mysql_query("SELECT `login`,`activated` FROM `[users]` WHERE `login`='{$_POST['login']}' AND `pass`=MD5('{$_POST['pass']}')");
    to:
    PHP:
    if(isset($_POST['login'],$_POST['pass'])) {
        $dbres = mysql_query("SELECT `login`,`activated` FROM `[users]` WHERE `login`='" . quote_smart($_POST['login']) . "' AND `pass`=MD5('" . quote_smart($_POST['pass']) . "')");
  2. switch to using PDO and prepared statements.
 
Last edited:
Status
Not open for further replies.
Top