note 97691 deleted from function.imagettftext by danbrown
| From: | danbrown@php.net | Date: | Mon, 03 May 2010 16:03:38 +0000 |
| Subject: | note 97691 deleted from function.imagettftext by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-168888@lists.php.net to get a copy of this message | ||
Note Submitter: razvan_bc at yahoo dot com
----
this is respons for
adam at worldwrestlingmania dot cjb dot net
06-Dec-2009 04:35(here http://php.net/manual/en/function.imagettftext.php)
and for all that's using captcha to prevent send information in a form using a robot.
People you don't need captcha!!!! There is another convenient method , to protect a website for
spamming and is much simple:
Let's consider the 1st page(with the form) and let's say the second ... index.php and
receiver.php
index.php:
----------------------------------------------------------------------
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML>
<HEAD>
<TITLE>index.php</TITLE>
</HEAD>
<BODY>
<?php
echo('this is the form`s page');
?><FORM METHOD=POST ACTION="receiver.php">
<INPUT TYPE="text" NAME="data"> <INPUT
TYPE="submit" VALUE="send!" NAME="send"><BR>
A form without captcha!!!
</FORM>
</BODY></HTML>
----------------------------------------------------------------------
receiver.php
----------------------------------------------------------------------
<?php
//receiver.php
function protectform(){
if($_SERVER["REQUEST_METHOD"]!='GET'){
$servername=$_SERVER["SERVER_NAME"];
$noterror=true;
if (isset($_SERVER["HTTP_REFERER"]))
$gethost=Parse_url($_SERVER["HTTP_REFERER"]);
else
$noterror=false;
$pimp=false;
if (!$noterror )
$pimp=true;
if(isset($gethost))
if ($gethost['host']!==$servername)
$pimp=true;
if ($pimp){
//print_r($gethost);
die('Go away hacker!');
}
}
}
protectform();
if(isset($_REQUEST['send'])and (trim($_REQUEST['data'])!='') )
echo('We already send to this page this
value: '.$_REQUEST['data'].'<br>'); else echo('Please
try to fill something in that form!');
?><A HREF="index.php">Return to my form</A>
----------------------------------------------------------------------
how to probe it?
well let's say you already upload it on
www.example.com/myfolder/ index.php and receiver.php
so try to digit
www.example.com/myfolder/index.php
now fill the form's value...and click send.
now is redirected to receiver.php and you see the right value.
Let's probe the vulnerability of the script:
digit again
www.example.com/myfolder/index.php
now when you see the form press File/Save as from the browser's menu and save it on desktop
like index.html
now try to open with notepad to edit it and change this line:
<FORM METHOD=POST ACTION="receiver.php">
to something like this:
<FORM METHOD=POST ACTION="http://www.example.com/myfolder/receiver.php">
now save it and double click it from desktop.
well what you see when you already fill that text form and you send the data to
www.example.com/myfolder/ ?
(For php beginners:www.example.com can be www.banana.com too , i don't know where you will
probe this software)
to all people who said :"php is unsecure" i respond with :
I am writing scripts from 1992, my opinion like expert is : php rooooooooolez!!! people if you
don't know how to write scripts in php try php.net to learn something. me,Constantin