cereal 1,524 Nearly a Senior Poster Featured Poster

Sorry, I didn't edit in time.

Edit 2

I'm probably wrong, because actually there are few conditions: capitalization matters, you cannot use characters of the name and if you choose more than one character from the username, then the password cannot be choosed. So it is much more complicated, but you still know that you can exclude all those combinations.

Going back to my corner to think è_é and sorry for the off-topic.

cereal 1,524 Nearly a Senior Poster Featured Poster

Interesting thread. In Yahoo mail when you set the password you are not allowed to use the characters included in the username, no matter if you're using only one of those characters and this check is case insensitive. But they still want at least an uppercase character. In my opinion this solution is self-defeating because an attacker will know what characters can omit from the bruteforce.

For example, if the username is deceptikon we can exclude 18 characters: decptikon and DECPTIKON, if the minimum password length is 8, then it translates to:

((44^8) * 100) / (62^8)

Where 62 is a-zA-Z0-9. It means that, by excluding the known characters, the combinations to check can be reduced to 6.43% of the total, which is a huge difference. Not only this, but increasing the lenght, the range will continue to drop: with a length of 12, the combinations to check will be only 1.63% of the total (62^12), it will be always a big number of combinations, but why they exclude those characters, I don't see the logic of this decision. Or my observations are wrong?

EDIT
Ok, I'm probably wrong, because actually there's a condition: if you choose more than one character equal to the username, then the password cannot be used. So is much more complicated, but you still know that you can exclude all those combinations that include at least 2 of the username characters, if you apply this to a dictionary you can limit a …

cereal 1,524 Nearly a Senior Poster Featured Poster

Can you explain better what you want to achieve?

I just want point relation between Word A, B, C to Z

Are you referring to the signifier or to the meaning?

cereal 1,524 Nearly a Senior Poster Featured Poster

If the ftp user is not apott then add it to the apott-site group. That should fix the problem.

cereal 1,524 Nearly a Senior Poster Featured Poster

You have to enable the module, you can do this at compilation or by adding:

extension=soap.so

to the configuration file of PHP, usually there is a conf.d directory where you can create files with these instructions, for example in my machine is under /etc/php5/apache2/conf.d/, you create soap.ini with permissions and save the above instruction. After you reload Apache, the module should be loaded.

Note: in linux you have multiple php.ini files and so also multiple conf.d directories, depending if this is for apache2, cli, cgi, fpm... so you can enable soap in the cgi version, but it will be disabled in apache2, for example.

cereal 1,524 Nearly a Senior Poster Featured Poster

Change line 12 to:

if ($redirect === true) {

And change the single quotes with double quotes on line 13:

header("Location:$redirect_page");

Docs: http://www.php.net/manual/en/language.types.string.php#language.types.string.parsing

mattyd commented: Great contributor here! +7
cereal 1,524 Nearly a Senior Poster Featured Poster

Ok, if we are done here, please mark it solved.

cereal 1,524 Nearly a Senior Poster Featured Poster

This is the same request of your previous thread but with a different schema to match:

Probably you can apply my suggestion by changing the pattern in preg_match(). Also we still don't know the code of cut_str(), please refer to my question in the previous thread. If we don't know how it works a user defined function, we cannot help you to fix it.

cereal 1,524 Nearly a Senior Poster Featured Poster

If this is not a production server, but only for testing, you can add your user to www-data group:

usermod -a -G www-data apott

If in this server there's another user added to the same www-data group he would have the ability to read or rewrite your code. The same happens with onsponge suggestion. I tend to use this approach when testing, but only because I'm using my box. So be careful with this solution.

In production context you should create a user and a group for each website, for example website123, or in your case apott, and then add the www-data user to the website group. That way the website user cannot access to the other websites scripts, but Apache can because is member of each group:

usermod -a -G website123 www-data

Regarding your CGI scripts you could use SuexecUserGroup:

or just follow the previous suggestions. Please, correct me if I'm wrong.

cereal 1,524 Nearly a Senior Poster Featured Poster

The reason why we turn URLs into clickable links within code snippets is because sometimes snippets include comments with a link crediting the origin of the source code and that type of thing

Ok, thank you for your reply.

Please, mine is just an opinion, not a complaint. I'm paying attention to this just because the links are crossed out in the code blocks. To me it's not a problem if a link is clickable or not, I was only suggesting a solution.

If a link is going to be overlined because is broken, then it can become difficult to read, at least for me: many times in the threads we use example links, to request help with rewrites or just to show the structure of an url. That line does not help me to answer, it just make it difficult to read.

Bye :)

cereal 1,524 Nearly a Senior Poster Featured Poster

In my opinion in the code blocks this is distracting. The link should not be clickable by default, no matter if this is broken or not and mantain his readability.

:)

cereal 1,524 Nearly a Senior Poster Featured Poster

Maybe I know what is happening, in the other thread I suggested you to create the table manually, maybe the one you created through PHPMyAdmin was myisam instead of a temporary table. This would explain why is not deleted.

Drop it and then adjust the create query in your script, this currently won't work because the closing parenthesis is missing, so change it with this:

$query_createTemporaryTable = "CREATE TEMPORARY TABLE temp(temp_id INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY, ArtistName VARCHAR(20), NAMEOfTheDVD VARCHAR(30))";

$result_createtemptable = mysql_query($query_createTemporaryTable , $dbhandle) or die(mysql_error());

Bye!

cereal 1,524 Nearly a Senior Poster Featured Poster

can we not create Tables using PHP code?

Yes, it is possible, but you need a persistent connection otherwise create this table with another engine, you could use the memory engine for example, it should work fine because is deleted when the server is reloaded or when you drop the table.

Also, you should move to MySQLi or PDO, the MySQL library is going to be removed from PHP.

I'm glad it's fine, bye! :)

cereal 1,524 Nearly a Senior Poster Featured Poster

Ok, if you still want to create a temporary table, use my suggestion, change your code, then modify the insert query to:

$query_insertintotable = "INSERT INTO everything (ArtistName, NAMEoftheDVD) VALUES ('RIHANNA', 'SHAWSHANK')";
$result_insertintotable = mysql_query($query_insertintotable, $dbhandle) or die(mysql_error());

Where NAME of the DVD is NAMEoftheDVD or name_of_the_dvd as in my example.

Note that the temporary table will be deleted at the end of the script.

cereal 1,524 Nearly a Senior Poster Featured Poster

Also the name of a column cannot contain whitespace, use underscores instead, so Name of the DVD becomes name_of_the_dvd. That's probably why your temporary table does not work, you can change the first query to:

$query_createTemporaryTable = "CREATE TEMPORARY TABLE temp(temp_id INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY, ArtistName VARCHAR(20), name_of_the_dvd VARCHAR(30))"; 
$result_createtemptable = mysql_query($query_createTemporaryTable , $dbhandle) or die(mysql_error());
cereal 1,524 Nearly a Senior Poster Featured Poster

Yes, create the table with the columns you need and then post the result of the explain command here, or just post the create statement. After that we can fix your queries.

cereal 1,524 Nearly a Senior Poster Featured Poster

Yes, without the dot, just explain temp;

cereal 1,524 Nearly a Senior Poster Featured Poster

Without the semi-colon at the end of mysql_query():

$result_selecttemptable = mysql_query($query_selecttemptable, $dbhandle) or die(mysql_error());

And with die(mysql_error()) which is more useful because it will display the actual error or the query.

cereal 1,524 Nearly a Senior Poster Featured Poster

Yes, try the suggestions in my previous post and let us know the results.

Edit

Hmm looking better at your code, I doubt that this would work:

"SELECT ArtistName,NAME of the DVD FROM temp";

Can you show us the structure of this table? Run explain temp; from a MySQL table and paste here the result.

cereal 1,524 Nearly a Senior Poster Featured Poster

@Mohamed don't worry about her, she's a spammer.

Regarding your problem, try to change this:

$result_selecttemptable = mysql_query( $query_selecttemptable,$dbhandle);
$row_selecttemptable = mysql_fetch_array($result_selecttemptable, $dbhandle);
while($row_selecttemptable = mysql_fetch_array($result_selecttemptable, $dbhandle)){
      echo $row_selecttemptable
      or die mysql_error("Error");
  }

To:

$result_selecttemptable = mysql_query($query_selecttemptable,$dbhandle) or die(mysql_error());

while($row_selecttemptable = mysql_fetch_array($result_selecttemptable))
{
    echo $row_selecttemptable['ArtistName'];
}
cereal 1,524 Nearly a Senior Poster Featured Poster

Same here on:

  • Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
  • Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0

I've seen this in many threads in the last few days.

cereal 1,524 Nearly a Senior Poster Featured Poster

The big problem here is that cells_num, grid_num and cell_weight do not have a suffix, as the others, that would simplify a lot the game. Anyway, if these groups are of fixed length you can split them and then rearrange as you like. An example:

<?php

include 'array.php';

function ohoh($a, $needle)
{
    $result = array();
    $i = 0;
    foreach($a as $key => $value)
    {
        foreach($value as $kv => $vv)
        {
            preg_match("(.*title|.*content)", $kv, $res);
            if(count($res))
            {
                $result[$i][$res[0]] = $vv;
                if(strstr($res[0], 'content')) $i++;
            }

            preg_match('/(grid_num|cells_num|cell_weight)/', $kv, $rs);
            if(count($rs) > 0) $result[$kv] = $vv;
        }
    }

    return $result;
}

function fire($a, $keys)
{
    $length = count($a) / count($keys);
    $arrays = array_chunk($a, $length);
    $result = array();

    $i = 0;
    foreach($arrays as $array)
    {
        $result[]['tabs'] = ohoh($array, $keys[$i]);
        $i++;
    }

    return $result;
}

$keys = array('rEXMp', '3T2IV');

echo "<pre>";
print_r(fire($a, $keys));
echo "</pre>";

Will print:

Array
(
    [0] => Array
        (
            [tabs] => Array
                (
                    [0] => Array
                        (
                            [tab-title] => tab-1
                            [tab-content] => tab-1 content
                        )

                    [1] => Array
                        (
                            [tab-title] => tab-2
                            [tab-content] => tab-2 content
                        )

                    [2] => Array
                        (
                            [tab-title] => tab-3
                            [tab-content] => tab-3 content
                        )

                    [cells_num] => 1
                    [grid_num] => 0
                    [cell_weight] => 100%
                )

        )

    [1] => Array
        (
            [tabs] => Array
                (
                    [0] => Array
                        (
                            [tab-title] => tab-4
                            [tab-content] => tab-4 content
                        )

                    [1] => Array
                        (
                            [tab-title] => tab-5
                            [tab-content] => tab-5 content
                        )

                    [2] => Array
                        (
                            [tab-title] => tab-6
                            [tab-content] => tab-6 content
                        )

                    [cells_num] => 1
                    [grid_num] => 1
                    [cell_weight] => …
cereal 1,524 Nearly a Senior Poster Featured Poster

Hi,

I'm not sure if is this but: neither the From: header, nor the Reply-To: are correct email addresses. In the From header is missing the local part, i.e. the part that goes before @:

"From: Bright-Tutors <bright-tutors.com> \n";

In the Reply-To the missing part is the top level domain, it should be:

"Reply-To: enquiries@bright-tutors.com\n";

You can also try to change all the \n with \r\n. And consider the use of the SwiftMailer library: http://swiftmailer.org/

cereal 1,524 Nearly a Senior Poster Featured Poster

Check this: http://trends.builtwith.com/javascript/jQuery-UI

According to their statistics there are about 6 million websites that use JQueryUI.

cereal 1,524 Nearly a Senior Poster Featured Poster

So, what have you done so far?

cereal 1,524 Nearly a Senior Poster Featured Poster

I would like as AG would, but we still don't know what it does cut_str(), you're showing us the application use, not the source code of that function.

This is source that we don't know and that only you can check:

function cut_str($arg1, $arg2)
{
    # do the magic here
}

This is application:

echo cut_str($pagina, $codetomatch);

We need to see the source. Have you enabled some PHP module that gives you extra functions?

If you run this code:

$functions = get_defined_functions();
echo 'User Defined Functions:' . PHP_EOL;
print_r($functions['user']);
echo 'Included files:' . PHP_EOL;
print_r(get_included_files());
echo 'Loaded Extensions:' . PHP_EOL;
$exts = get_loaded_extensions();
natcasesort($exts);
print_r($exts);

What do you get?

A part from the above, your function tries to match this:

<tr>
    <td width="133" align="right" valign="top">Genero : </td>
    <td width="329" align="left" valign="top"><a href='http://www.yaske.net/es/peliculas/genero/drama'>Drama</a><a href='http://www.yaske.net/es/peliculas/genero/action'>Accion</a><a href='http://www.yaske.net/es/peliculas/genero/biography'>Biografias</a><a href='http://www.yaske.net/es/peliculas/genero/sport'>Deporte</a></td>
</tr>

the <td> that contains the links is only one, I think here the match should be repeated, the first time to get the <td> contents, the second to strip the <a> tags, but an easy and rough example is this:

<?php

$url = "http://www.yaske.net/es/pelicula/0003843/ver-rush-online.html";
$pagina = file_get_contents($url);
preg_match_all('/<tr>\s*<td[^>]*?>Genero\s*:\s*<\/td>\s*<td[^>]*?>(.*)<\/td>\s*<\/tr>/i', $pagina, $links);

if(count(array_filter($links)) == 0) die('Error!');

$links = array_filter(explode('</a>', $links[1][0]));
$links = implode(', ', array_map('strip_tags', $links));
echo $links;

That outputs:

Drama, Accion, Biografias, Deporte
cereal 1,524 Nearly a Senior Poster Featured Poster

This happens because of the X-Frame-Options header, if the remote server uses a directive like this:

Header always append X-Frame-Options SAMEORIGIN

The browser will check and won't allow the iframes, unless you don't use a local script through Greasemonkey or Tampermonkey. It means your users should install it on their browsers to bypass that kind of block.

Otherwise you could contact some of these website to be allowed, they can create a directive like this:

Header always append X-Frame-Options ALLOWFROM http://yourwebsite.tld/

DOCS:
* https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
* http://tools.ietf.org/html/rfc7034

cereal 1,524 Nearly a Senior Poster Featured Poster

A small correction: you cannot compare booleans with integers, otherwise you get unexpected results. An example:

$a['foo'] = FALSE;
echo (int)$a['foo'] !== FALSE ? 'true':'false';

The problem here is given by (int). The comparison will translate to 0 !== FALSE which returns true instead of false, the same happens if the value is NULL.

Tpojka commented: Thanks for clarification. +1
cereal 1,524 Nearly a Senior Poster Featured Poster

That's ok :)

cereal 1,524 Nearly a Senior Poster Featured Poster

Happy New Year! :)

cereal 1,524 Nearly a Senior Poster Featured Poster

Ok. Maybe I'm missing something, but from what I see, I think your script should not work, because it needs some specific conditions. For example: register_globals is on? The documentation of session_register() says:

If your script uses session_register(), it will not work in environments where the PHP directive register_globals is disabled.

As of PHP 4.2.0, the default value for the PHP directive register_globals is off. The PHP community discourages developers from relying on this directive, and encourages the use of other means, such as the superglobals.

And:

Caution
If you are using $_SESSION (or $HTTP_SESSION_VARS), do not use session_register(), session_is_registered(), and session_unregister().

Reference: http://www.php.net/manual/en/function.session-register.php

Your intent is to make the first part (up to line 17) work with the second (after line 19)? If yes, remove session_register() and the others, as suggested by the documentation and use $_SESSION to make it work.

You should, also, get some errors because session_start() is declared only at line 23 while it should be in the first line of the script.

cereal 1,524 Nearly a Senior Poster Featured Poster

Do you have something like include or require in top of your script? Check in those files.

cereal 1,524 Nearly a Senior Poster Featured Poster

Use the $_SESSION array instead:

At the top of the script place session_start(), then define the variables you want to save to session, for example:

<?php

    session_start();

    $_SESSION['username'] = 'Stefan';

    echo $_SESSION['username'];

Regarding the form, I cannot help much on the javascript side, but you have to be sure the logged user cannot submit to the login script, not only that the form is visible or not. This means you have to filter the requests to the script, you could place this in top:

<?php

    session_start();

    if(array_key_exists('username', $_SESSION))
    {
        $_SESSION['error_flashdata'] = 'Already logged';
        header('Location: /');
    }

Then if you want, you can apply a session variable to send and display error messages in the landing page, in this case as you see in the header(), the redirect points to the homepage:

<?php

    session_start();
    $error = false;

    if(array_key_exists('error_flashdata', $_SESSION))
    {
        $error = $_SESSION['error_flashdata'];
        unset($_SESSION['error_flashdata']);
    }

    echo $error;
cereal 1,524 Nearly a Senior Poster Featured Poster

The first argument of session_is_registered() must be a string, in your case myusername is not a constant, it's a string, so add the quotes:

if(session_is_registered('myusername'))

In addition these functions will be removed from PHP 5.4, their use is highly discouraged:

cereal 1,524 Nearly a Senior Poster Featured Poster

As I wrote:

The cut_str() is a user defined function, so if you want to use it you have to show us your code

To be more accurate, show the code that defines cut_str() not the usage, i.e.:

function cut_str()
{
    # show us this code
}

Also you could use strip_tags() around it, for example:

echo strip_tags($jm_anime_genero);
cereal 1,524 Nearly a Senior Poster Featured Poster

The cut_str() is a user defined function, so if you want to use it you have to show us your code, otherwise use preg_match_all(), here's an example:

function scrapit($data)
{
        preg_match_all('/[<a[^>]*?>(.*)<\/a>/i', $data, $matches);

        if($matches === false || count($matches) == 0) return false;
        return implode(', ', $matches[1]);
}

To test it:

$html = <<<EOT
        <tr>
        <td width="133" align="right" valign="top">Genero : </td>
        <td width="329" align="left" valign="top">
                <a href='http://www.yaske.net/es/peliculas/genero/drama'>Drama</a>
                <a href='http://www.yaske.net/es/peliculas/genero/action'>Accion</a>
                <a href='http://www.yaske.net/es/peliculas/genero/biography'>Biografias</a>
                <a href='http://www.yaske.net/es/peliculas/genero/sport'>Deporte</a>
        </td>
        </tr>
EOT;


print_r(scrapit($html));

It will output:

Drama, Accion, Biografias, Deporte

Docs: http://php.net/manual/en/function.preg-match-all.php

cereal 1,524 Nearly a Senior Poster Featured Poster

The PDO connection takes 3 arguments: the first is used to set the kind of database mysql: then you set the hostname host= and the database name dbname=; the second argument is the username; and the last one is the password. All these values are strings, so use the quotes:

$odb = new PDO("mysql:host=mysql5.000webhost.com;dbname=a4455745_lool", "a4454514_root", "Examplepass123");
cereal 1,524 Nearly a Senior Poster Featured Poster

There is a little typo at line 6, the closing parenthesis is after the double quote, so it is outside the query expression. Change it with this:

$wpdb->get_row("SELECT name FROM country WHERE parent IN (SELECT parent FROM country WHERE name == '$page_name')");
cereal 1,524 Nearly a Senior Poster Featured Poster

Start from the database, for example MySQL: when you enter something, if the table has a primary key and this is numeric and increments automatically, i.e.:

id int(10) primary key autoincrement not null

then you can use last_insert_id() to get the last data entered in the table. The above is a MySQL function, but you can get the same result with the libraries provided by PHP, or you can simply query after you do an insert:

select last_insert_id();

Now, if you want to display data related to a specific user, for a specific user then create a authorization procedure to create a session, for example a login form. When the script validates the request, start a session in which you save the ID of the user:

$_SESSION['userID'] = $row['id'];

And redirect the user to the restricted area, here you can use the header():

header('Location: /profile');

So if we want to create a simple form:

<form method="post" action="/login.php">
    username <input type="text" name="username" /><br />
    password <input type="password" name="password" /> <br />
    <input type="submit" name="submit" value="login" />
</form>

And the login.php page:

<?php

    session_start();

    if($_POST && array_key_exists('username', $_POST) && array_key_exists('password', $_POST))
    {
        $sql = new PDO('mysql:host=localhost;dbname=test', 'username', 'password');
        $sql->prepare("select id from users where username = ? AND password = ? limit 1");
        $sql->execute(array($_POST['username'], sha1($_POST['password'])));

        if($sql->rowCount() > 0)
        {
            $result = $sql->fetch(PDO::FETCH_ASSOC);
            $_SESSION['userID'] = $result['id'];

            header("Location: /profile.php");
        }
        else
        {
            # back to the login form
            header("Location: $_SERVER[HTTP_REFERER]");
        }
    }
    else
    {
        echo 'Not allowed';
    }

The …

The_Thorn commented: Great! TY for your detailed help. +0
cereal 1,524 Nearly a Senior Poster Featured Poster

Change the IF statement to:

if($submit == 'submit' && strlen($service_name) > 0 && strlen($service_content) > 0)

@broj1 sorry, I didn't saw your answer, bye!

cereal 1,524 Nearly a Senior Poster Featured Poster

The problem is given by the double quotes inside the date function, you're breaking the quotes of the echoed string, if you escape them then it will print the line without executing the code.

So, you can get the output by setting a variable and include it in the string:

$date = date("Y/m/d");
echo "<div class='date'>$date</div>";
echo '<div class=\'date\'>$date</div>';

Check the output of the above example. Do you see the differences between single and double quotes? Here's the documentation:

An alternative syntax:

echo "<div class='date'>" . date("Y/m/d") . "</div>";
cereal 1,524 Nearly a Senior Poster Featured Poster

The variable values, in this case, must be strings, so surround them with quotes:

$dbhost = "sql.domain.tld";
$dbuser = "username";
$dbpass = "password";

The port value can be submitted as integer, so you can omit the quotes. Anyhow, by adding mysql_error() you should be able to see the error.

Since you're rewriting the code I suggest you to switch to PDO or MySQLi libraries, because the one you're currently using is going to be removed from PHP, so check:

cereal 1,524 Nearly a Senior Poster Featured Poster

the result is not where it suppse to show in the $content or the $ourput Its showing in the header of the template

I'm not sure I've understood your request, it seems some code is missing. I suppose the view page above is not the template page but the one accessed by:

$this->data['content'] .= $this->load->view($view_path, $this->data, true);

Correct? If yes, the template:

<div id="content">
    <?php echo $content;?>
<?php
echo @$output;
?>
</div>

Will include the entire "view page" and so you should get something like this:

<div id="content">
    <html>
    <div id="total">
      <label id="total">AVAILABLE BALANCE = </label>
      <span><?php echo $total; ?></span>
    </div>
    </html>
</div>

Is it this the problem you were talking about?

Are you loading other contents through $this->data['content']? I see you're using .= this will concatenate strings, so can you show how this starts?

Another problem is here:

function index() {
    $this -> _example_output((object) array('output' => '', 'js_files' => array(), 'css_files' => array(), 'data' => array()));
}

It seems wrong to me, because the _example_output() method expects two arguments:

function _example_output($page_set = null, $output = null) {
    $this -> load -> view($page_set, $output,FALSE);
}

The index() method, instead is sending only the first argument which should be a string, not an array (i.e. the second argument), since both can be NULL you have to declare the first argument. In pseudo code:

func(NULL, (object) array('value1', 'valueN'))

In your case it becomes:

function index() {
    $this -> _example_output(NULL, (object) array('output' => '', 'js_files' …
cereal 1,524 Nearly a Senior Poster Featured Poster

happy holidays! ^_^

cereal 1,524 Nearly a Senior Poster Featured Poster

As I wrote in my previous post, this is not secure:

$rooturl= "http://" . $_SERVER["SERVER_NAME"] . "/";

PHP documentation says:

SERVER_NAME
The name of the server host under which the current script is executing. If the script is running on a virtual host, this will be the value defined for that virtual host.

So it depends on the Apache configuration, the problems comes in here: in misconfigured servers the host name can be overwritten by the client header because the UseCanonicalName directive is Off by default:

With UseCanonicalName Off Apache will form self-referential URLs using the hostname and port supplied by the client if any are supplied (otherwise it will use the canonical name, as defined above).

How this affects your script

Set up a page (name.php) with only this:

echo "http://".$_SERVER['SERVER_NAME']."/";

Then from another script run this code:

<?php

$url = "http://good.dev/name.php";
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('HOST: evil.dev'));
curl_setopt($ch, CURLOPT_PROXY, "http://good.dev:80");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
$result = curl_exec($ch);
curl_close ($ch);

print_r($result);

You expect to get http://good.dev/, i.e. your domain name, but you can get http://evil.dev/. Depending on the configuration of the server.

Since you're saving the absolute url into the database, if I can manipulate $_SERVER['SERVER_NAME'] I can create a link like this one:

http://evil.dev/users/images/filename.png

The relative path is the same, the name of the file too, but the domain is different. Old browsers can run javascript …

cereal 1,524 Nearly a Senior Poster Featured Poster

Yes, in the arrays you start to count from zero, you can see all the structure by using print_r():

print_r($file);
cereal 1,524 Nearly a Senior Poster Featured Poster

Sorry, check these links:

And let say you're using this script:

<?php

$key = "this is a secret key";
$input = "Let us meet at 9 o'clock at the secret place.";

$td = mcrypt_module_open('tripledes', '', 'ecb', '');
$iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
mcrypt_generic_init($td, $key, $iv);
$encrypted_data = mcrypt_generic($td, $input);
mcrypt_generic_deinit($td);
mcrypt_module_close($td);

echo $encrypted_data;
echo "<br />";
echo mcrypt_decrypt('tripledes', $key, $encrypted_data, 'ecb', $iv);

If I'm able to access your system and steal the $key, then I can decrypt everything, no matter how strong is the encryption. This is why I'm talking about other factors. You cannot consider something secure if you do not consider also the environment in which this modus operandi will be used.

Hope is more clear now, my English is not good, since this is not my native language.

cereal 1,524 Nearly a Senior Poster Featured Poster

The second xml file is not correct, here's the fixed version:

<?xml version="1.0" ?>
<sys>
    <major>
        <id>1</id>
        <point>Tower</point>
    </major>
    <major>
        <id>2</id>
        <point>Castle</point>
    </major>
</sys>

Now, you basically get an object array, so:

echo $file->major[0]->id . ' ' . $file->major[0]->point;

And if you loop it:

foreach($file as $key => $value)
{
    if($value->id == 1) echo $value->point;
}

You get the same results.

RikTelner commented: Finally someone who understands that question and answers correctly. +0
cereal 1,524 Nearly a Senior Poster Featured Poster

Who knows :)

But I would hazard by saying no. Let's say new technologies could speed up the decryption, or they could find a flaw in the algorithm, or they could add an hidden backdoor into the new chips: once you change one of the components in your server, or in one of the other boxes in the same network, the entire system would be compromised and they could access the decryption key. As example.

cereal 1,524 Nearly a Senior Poster Featured Poster

Ditto. I've lost ~50 posts (I was over 1500) and 28 points on reputation, but it's fine for me too.