Shoutbox

quote:

---

Originally posted by M73A
$find javascript $ Delete

---

The function I showed you removes (or at least tries to) remove all HTML + PHP from the input string. That includes javascript and should leave clean text.

quote:

---

Originally posted by Ezra

quote:

---

Originally posted by M73A
$find javascript $ Delete

---

The function I showed you removes (or at least tries to) remove all HTML + PHP from the input string. That includes javascript and should leave clean text.

---

oh crap sorry, i thought that was an example of something malicious sorreh ^_^


hm i tried putting it in but it didnt work. where would you advise to put it?

quote:

---

Originally posted by M73A
hm i tried putting it in but it didnt work. where would you advise to put it?

---

code:

---

$fp = fopen("shouts.txt","a");
   fseek($fp, 0);
   fwrite($fp,strip_tags($_POST['user']).":".strip_tags($_POST['shout'])."\n");
   fclose($fp);
   $shoutbox_page = "http://pps3.awardspace.com/Shoutbox/index.php";
   header("Location: $shoutbox_page");

---

Bold parts are the changed parts.

I also added my other suggestion about your add to top of the file problem, the fseek will put the pointer at the start of the file.

EDIT: However, I'm not sure how fwrite writes the string to it, if it will overwrite what is already there or it will add it before the rest, I actually think it's the first, so it might not be that helpful , but the strip_tags are unaffected, so you can still copy that part

EDIT2: Indeed I was right, there is no prepend mode, so with fseek the contents will be overwritten, nevermind that then, just use the other suggestions about the prepending.

YAYYYY

Thanks

come here asking about locations, and get extra help about security!!

Thanks buddy!

Where is it btw, i'd like to see it

If a username has ':' or a shout contains ':', this might not work properly .

quote:

---

Originally posted by Napbree
Where is it btw, i'd like to see it

---

http://pps3.awardspace.com/ its there, mentality got me to help him make some ps3 clan thing, personally i think he should buy me a ps3

Jesus, thats very unsecure, and spam not proof

quote:

---

Originally posted by Napbree
Jesus, thats very unsecure, and spam not proof

---

lol yep ^_^

add this:

code:

---

if(empty($_POST['shout'])) {
echo "Sorry its empty";
}

---