PHP RSS PHP RSS

Admin Panel script

Reply

•
•
Join Date: May 2008
Posts: 113
Reputation: Merlin33069 is an unknown quantity at this point 
Solved Threads: 4
Merlin33069 Merlin33069 is offline Offline
Junior Poster

Admin Panel script

 
0
  #1
Mar 30th, 2009
WARNING
huge php script, watch your head
/WARNING

Ok, i want to start by saying that this is part of a free script im making and therefor may be used by anyone, the script if available at:


http://pctipforum.com/index.php?topic=345.0

next i want to say that this is a login script for the admin panel of the above utility, the utility is a php based guestbook

This admin panel, for now, offers the person whom uses it the ability to delete and entry from the guestbook, at the time it does not work

I think there is a piece missing where its marked, youll see it torward the end like this:

//---------------------------------
//<--- SOMETHING GOES HERE --->
//---------------------------------

some part of the script is not escaped with a } and so its missing a piece, the script WAS functional, when it had multiple pages, ie this page linked to another page to parse the form..

but after i got about 30 pages in this simple to use guestbook, it became too complicated, as such i put them into one page, and now i cant figure out what im missing ><

please help

PHP Syntax (Toggle Plain Text) 
  1.  
  2. <?PHP
  3. //turn off error reporting...
  4. error_reporting(0);
  5.  
  6. //Include the file with the password
  7. include ("Config.php");
  8.  
  9. //Convert the username and password into usable strings
  10. $user = $_POST['user'];
  11. $pass = $_POST['pass'];
  12.  
  13. //We need to disable the first parse of this script, which is when the person first come to the page...
  14. if($user=="")
  15.  
  16. {
  17. 	echo '
  18. 	<center>
  19. 	<table border="0">
  20. 	<form method="POST" action="A_login.php">
  21. 	<tr><td>
  22. 	Admin Username:
  23. 	<td>
  24. 	<input type="text" name="user">
  25. 	<tr><td>
  26. 	Admin Password:
  27. 	<td>
  28. 	<input type="password" name="pass">
  29. 	<tr><td>
  30. 	Submit:
  31. 	<td>
  32. 	<input type="submit" value="Submit">
  33. 	</form>
  34. 	</table>
  35. 	</center>
  36. 	<center>
  37.  	This will display the FULL guestbook, it gets quite long....
  38.  	</center>
  39. 	';
  40.  
  41.  	die(''); 
  42. }
  43.  
  44. if($Delete=="")
  45.  
  46.  
  47. {
  48. 	//Check username and password
  49. 	if (($user=="$Ad_Username") && ($pass=="$Ad_Password"))
  50. 	{
  51. 		//if its right, we can go ahead and display the info
  52.  
  53. 		echo '
  54. 		<br><br>
  55. 		<center>
  56. 		<h2>THIS WILL DELETE WHATEVER NUMBER YOU INPUT!</h2>
  57. 		</center>
  58. 		<br>
  59. 		<center>
  60. 		<table border="0">
  61. 		<form method="POST" action="A_login.php">
  62. 		<input type="hidden" value="$user" name="user">
  63. 		<input type="hidden" value="$pass" name="pass">
  64. 		<tr><td>
  65. 		DELETE NUMBER:
  66. 		<td>
  67. 		<input type="text" name="Delete">
  68. 		<tr><td>
  69. 		Submit:
  70. 		<td>
  71. 		<input type="submit" value="Submit">
  72. 		</form>
  73. 		</table>
  74. 		</center>
  75. 		';
  76.  
  77. 		//Admin Guestbook, for use in the panel ONLY
  78. 		echo '<br><br><br>';
  79. 		echo '<center>';
  80. 		//This includes the Configuration file that should be in the same folder as this guestbook Script
  81. 		include ("Config.php");
  82.  
  83.  
  84. 		//This is where the Script connects to your database
  85. 		$con = mysql_connect("$Hostname","$Username","$Password");
  86. 		if (!$con)
  87. 		{
  88. 			die('Could not connect: ' . mysql_error());
  89. 		}
  90.  
  91. 		//Selects the database in config.php
  92. 		mysql_select_db("$Database", $con);
  93.  
  94. 		//Selects the info from the guestbook table and sets it as a variable
  95. 		$result = mysql_query("SELECT * FROM $Table ORDER BY Number DESC");
  96.  
  97. 		//This portion configures the table which will display the guestbook
  98. 		echo "<font color=$HeaderColor size=\"2\">FOR USE IN THE ADMIN PANEL ONLY</font>";
  99. 		echo '<br><br>';
  100. 		echo "<table width=\"80%\" Border=\"$TableBord\">";
  101. 		echo "<tr><td><font color=$HeaderColor>Number<td><font color=$HeaderColor>Smiley<td><font color=$HeaderColor>Name<td><font color=$HeaderColor>Date<td><font color=$HeaderColor>Comment<td><font color=$HeaderColor>Email<td><font color=$HeaderColor>IP";
  102.  
  103. 		//This is an array, it takes each entry into the guestbook and puts it on a line
  104. 		while($row = mysql_fetch_array($result))
  105. 		{
  106. 			Echo "<tr>";
  107. 			Echo "<td><font color=$EntryColor>";
  108. 			Echo $row['Number'];
  109. 			Echo "<td><img src=Smiley/";
  110. 			Echo $row['Smiley'];
  111. 			Echo ".gif>";
  112. 			Echo "<td><font color=$EntryColor>";
  113. 			Echo $row['Name'];
  114. 			Echo "<td><font color=$EntryColor>";
  115. 			Echo $row['Date'];
  116. 			Echo "<td><font color=$EntryColor>";
  117. 			Echo $row['Comment'];
  118. 			Echo "<td><font color=$EntryColor>";
  119. 			Echo $row['Email'];
  120. 			Echo "<td><font color=$EntryColor>";
  121. 			Echo $row['IP'];
  122. 		}
  123. 		Echo "</font>";
  124.  
  125. 		//Disconnect from the database
  126. 		mysql_close($con);
  127.  
  128. 		//End Admin Guestbook viewer
  129. 		echo '</center>';
  130. 		 die(''); 
  131. 	}
  132.  
  133. 	else
  134.  
  135. 	{ 
  136. 		die('Wrong username and or password!');
  137. 	}
  138.  
  139. //---------------------------------
  140. //<--- SOMETHING GOES HERE --->
  141. //---------------------------------
  142.  
  143. else 
  144.  
  145. { 
  146. 	//This includes the Configuration file that should be in the same folder as this Script
  147. 	include ("Config.php");
  148. 	echo "
  149. 	<a href=$LINK>Return</a>
  150. 	<br><br><br><br>
  151. 	";
  152.  
  153. 	//This is where the Script connects to your database
  154. 	$con = mysql_connect("$Hostname","$Username","$Password");
  155. 	if (!$con)
  156. 	{
  157. 		die('Could not connect: ' . mysql_error());
  158. 	}
  159.  
  160. 	//Selects the database in config.php
  161. 	mysql_select_db("$Database", $con);
  162.  
  163. 	$sql="DELETE FROM $Table WHERE Number='$_POST[Delete]'";
  164.  
  165. 	if (!mysql_query($sql,$con))
  166. 	{
  167. 		die('Error: ' . mysql_error());
  168. 	}
  169. 	echo "record deleted";
  170. }
  171.  
  172. ?>

p.s. yes i know its messy, yes i know i have a LOT of html being parsed by php, i will clean it up later, right now its like that for simplicities sake....

thanks in advance!
Do you geek alone?

<<TimmCo>> Custom Computers

~Executive
Reply With Quote Quick reply to this message  
•
•
Join Date: May 2008
Posts: 113
Reputation: Merlin33069 is an unknown quantity at this point 
Solved Threads: 4
Merlin33069 Merlin33069 is offline Offline
Junior Poster

Re: Admin Panel script

 
0
  #2
Mar 31st, 2009
ok, i found the problem, it was just a missing }

i tried that once, but it kept redirecting me to the same page i was on, so i thaught something else should go there...

the place i messed up is in the hidden inputs under one of the forms, the form assumes a variable that cannot be used...

here is the fixed and 100% working script:

PHP Syntax (Toggle Plain Text) 
  1.  
  2. <?PHP
  3. //turn off error reporting...
  4. error_reporting(0);
  5.  
  6. //Include the file with the password
  7. include ("Config.php");
  8.  
  9. //Convert the username and password into usable strings
  10. $user = $_POST['user'];
  11. $pass = $_POST['pass'];
  12. $Delete = $_POST['Delete'];
  13.  
  14. //We need to disable the first parse of this script, which is when the person first come to the page...
  15. if($user=="")
  16.  
  17. {
  18. 	echo '
  19. 	<center>
  20. 	<table border="0">
  21. 	<form method="POST" action="A_login.php">
  22. 	<tr><td>
  23. 	Admin Username:
  24. 	<td>
  25. 	<input type="text" name="user">
  26. 	<tr><td>
  27. 	Admin Password:
  28. 	<td>
  29. 	<input type="password" name="pass">
  30. 	<tr><td>
  31. 	Submit:
  32. 	<td>
  33. 	<input type="submit" value="Submit">
  34. 	</form>
  35. 	</table>
  36. 	</center>
  37. 	<center>
  38.  	This will display the FULL guestbook, it gets quite long....
  39.  	</center>
  40. 	';
  41.  
  42.  	die(''); 
  43. }
  44.  
  45. if($Delete=="")
  46.  
  47.  
  48. {
  49. 	//Check username and password
  50. 	if (($user=="$Ad_Username") && ($pass=="$Ad_Password"))
  51. 	{
  52. 		//if its right, we can go ahead and display the info
  53.  
  54. 		echo '
  55. 		<center>
  56. 		<h2>THIS WILL DELETE WHATEVER NUMBER YOU INPUT!</h2>
  57. 		</center>
  58. 		<br>
  59. 		<center>
  60. 		<table border="0">
  61. 		<form method="POST" action="A_login.php">
  62. 		<input type="hidden" name="user" value="';
  63.  
  64. 		echo $user;
  65.  
  66. 		echo '">';
  67.  
  68. 		echo '<input type="hidden" name="pass" value="';
  69.  
  70. 		echo $pass;
  71.  
  72. 		echo '">
  73. 		<tr><td>
  74. 		DELETE NUMBER:
  75. 		<td>
  76. 		<input type="text" name="Delete">
  77. 		<tr><td>
  78. 		Submit:
  79. 		<td>
  80. 		<input type="submit" value="Submit">
  81. 		</form>
  82. 		</table>
  83. 		</center>
  84. 		';
  85.  
  86. 		//Admin Guestbook, for use in the panel ONLY
  87. 		echo '<br><br><br>';
  88. 		echo '<center>';
  89. 		//This includes the Configuration file that should be in the same folder as this guestbook Script
  90. 		include ("Config.php");
  91.  
  92.  
  93. 		//This is where the Script connects to your database
  94. 		$con = mysql_connect("$Hostname","$Username","$Password");
  95. 		if (!$con)
  96. 		{
  97. 			die('Could not connect: ' . mysql_error());
  98. 		}
  99.  
  100. 		//Selects the database in config.php
  101. 		mysql_select_db("$Database", $con);
  102.  
  103. 		//Selects the info from the guestbook table and sets it as a variable
  104. 		$result = mysql_query("SELECT * FROM $Table ORDER BY Number DESC");
  105.  
  106. 		//This portion configures the table which will display the guestbook
  107. 		echo "<font color=$HeaderColor size=\"2\">FOR USE IN THE ADMIN PANEL ONLY</font>";
  108. 		echo '<br><br>';
  109. 		echo "<table width=\"80%\" Border=\"$TableBord\">";
  110. 		echo "<tr><td><font color=$HeaderColor>Number<td><font color=$HeaderColor>Smiley<td><font color=$HeaderColor>Name<td><font color=$HeaderColor>Date<td><font color=$HeaderColor>Comment<td><font color=$HeaderColor>Email<td><font color=$HeaderColor>IP";
  111.  
  112. 		//This is an array, it takes each entry into the guestbook and puts it on a line
  113. 		while($row = mysql_fetch_array($result))
  114. 		{
  115. 			Echo "<tr>";
  116. 			Echo "<td><font color=$EntryColor>";
  117. 			Echo $row['Number'];
  118. 			Echo "<td><img src=Smiley/";
  119. 			Echo $row['Smiley'];
  120. 			Echo ".gif>";
  121. 			Echo "<td><font color=$EntryColor>";
  122. 			Echo $row['Name'];
  123. 			Echo "<td><font color=$EntryColor>";
  124. 			Echo $row['Date'];
  125. 			Echo "<td><font color=$EntryColor>";
  126. 			Echo $row['Comment'];
  127. 			Echo "<td><font color=$EntryColor>";
  128. 			Echo $row['Email'];
  129. 			Echo "<td><font color=$EntryColor>";
  130. 			Echo $row['IP'];
  131. 		}
  132. 		Echo "</font>";
  133.  
  134. 		//Disconnect from the database
  135. 		mysql_close($con);
  136.  
  137. 		//End Admin Guestbook viewer
  138. 		echo '</center>';
  139. 		die(''); 
  140. 	}
  141.  
  142. 	else
  143.  
  144. 	{ 
  145. 		die('Wrong username and or password!');
  146. 	}
  147. }
  148.  
  149. else
  150.  
  151. { 
  152. 	//This includes the Configuration file that should be in the same folder as this Script
  153. 	include ("Config.php");
  154.  
  155. 		echo '
  156. 		<center>
  157. 		<table border="0">
  158. 		<form method="POST" action="A_login.php">
  159. 		<input type="hidden" name="user" value="';
  160. 		echo $user;
  161. 		echo '">';
  162. 		echo '<input type="hidden" name="pass" value="';
  163. 		echo $pass;
  164. 		echo '">
  165. 		<tr><td>
  166. 		<tr><td>
  167. 		<input type="submit" value="Return to admin page">
  168. 		</form>
  169. 		</table>
  170. 		</center>
  171. 		<br>
  172. 		<center>
  173. 		';
  174.  
  175.  
  176.  
  177. 	//This is where the Script connects to your database
  178. 	$con = mysql_connect("$Hostname","$Username","$Password");
  179. 	if (!$con)
  180. 	{
  181. 		die('Could not connect: ' . mysql_error());
  182. 	}
  183.  
  184. 	//Selects the database in config.php
  185. 	mysql_select_db("$Database", $con);
  186.  
  187. 	$sql="DELETE FROM $Table WHERE Number='$_POST[Delete]'";
  188.  
  189. 	if (!mysql_query($sql,$con))
  190. 	{
  191. 		die('Error: ' . mysql_error());
  192. 	}
  193. 	echo "record deleted, or did not exist, either way its no longer in the database...";
  194. }
  195. echo '</center>';
  196.  
  197. ?>

Have fun, and check out pctipforum.com
Do you geek alone?

<<TimmCo>> Custom Computers

~Executive
Reply With Quote Quick reply to this message  
•
•
Join Date: Jun 2007
Posts: 1,227
Reputation: kkeith29 has a spectacular aura about kkeith29 has a spectacular aura about kkeith29 has a spectacular aura about 
Solved Threads: 167
kkeith29's Avatar
kkeith29 kkeith29 is offline Offline
Nearly a Posting Virtuoso

Re: Admin Panel script

 
0
  #3
Mar 31st, 2009
First of all, there are some problems you need to address before anyone even thinks about downloading/using this. You have a username and password stored in plain text on the server. Not Good! A database should be used to store them. The password should be hashed as well. You also have post data going directly into queries. This is a huge sql injection hole. Also I couldn't find much valid xhtml or even html.

Security is a must in todays world. That will be hacked quickly.

Also, I looked at your demo. There is no spam prevention. You might want to fix that before someone starts spamming you.
Last edited by kkeith29; Mar 31st, 2009 at 1:23 am.
Reply With Quote Quick reply to this message  
•
•
Join Date: May 2008
Posts: 232
Reputation: samarudge is an unknown quantity at this point 
Solved Threads: 19
samarudge samarudge is offline Offline
Posting Whiz in Training

Re: Admin Panel script

 
0
  #4
Mar 31st, 2009
Also by compiling it into one script the file size is huge and it will take PHP a much longer time to parse the whole file
My Blog, Life and everything that matters to me - SamRudge.co.uk

2x Macbook Pro's, 1x Mac Pro, 1x iMac, 2x Macbook's running Fedora linux - In conclusion, I hate windows =)
Reply With Quote Quick reply to this message  
•
•
Join Date: May 2008
Posts: 113
Reputation: Merlin33069 is an unknown quantity at this point 
Solved Threads: 4
Merlin33069 Merlin33069 is offline Offline
Junior Poster

Re: Admin Panel script

 
0
  #5
Apr 13th, 2009
i know.

this was my first script, as such i was working piece by piece, the entire script is now split into a couple different files, and the database houses a few different hashed passwords.

This was a learning experience for me

also, on the spamming part of things, that was added later and i thank you for pointing it out anyway
Last edited by Merlin33069; Apr 13th, 2009 at 11:55 am. Reason: added last paragraph
Do you geek alone?

<<TimmCo>> Custom Computers

~Executive
Reply With Quote Quick reply to this message  
•
•
Join Date: Jul 2007
Posts: 258
Reputation: Designer_101 is an unknown quantity at this point 
Solved Threads: 12
Designer_101's Avatar
Designer_101 Designer_101 is offline Offline
Posting Whiz in Training

Re: Admin Panel script

 
0
  #6
Apr 13th, 2009
Yeh, some major holes in that :/
I wouldnt recomend anyone using it for security issues until you've fixed it up. Look up CSRF aswell, i've made it a mission to get more people protecting the forms against it. Also there is (as pointed out above) a huge SQL injection possible.
Hope this helps
Reply With Quote Quick reply to this message  
Reply

Quick Reply to Thread
This thread is more than three months old.
Perhaps start a new thread instead?
•
•
•
•
•
•
•
•
Message:
•
•
•
•



Similar Threads
Other Threads in the PHP Forum
Thread Tools Search this Thread



advanced apache api array basics beginner binary broken cakephp check checkbox class cms code codingproblem combobox cookies cron curl database date datepart display dynamic echo email error file files folder form forms function functions google head href htaccess html image include includingmysecondfileinthechain insert ip javascript job joomla js limit link login mail menu mlm mobile multiple mysql oop outofmemmory paging parse password paypal pdf php problem procedure query radio ram random recursion remote script search server sessions smarty sms source space sql stored syntax system table traffic tutorial unicode up-to-date update upload url validator variable video web webapplications websitecontactform youtube
About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC