PHP - Sql Injection Attempts... Should I Be Worried

Hello 

I'm on the verge of damaging my computer,    please help...

The below is my first PHP script - it works about once every 20 attempts, sending the email message. I've tried moving the header bit around, so it's inside the if statement, but it is still only intermittently successful.

For the sake of this PC, please help out 

Best Wishes 


<?
function checkOK($field)
{
if (eregi("\r",$field) || eregi("\n",$field)){
die("Invalid Input!");
}
}



$select=$_POST['select'];
checkOK($select);
$name=$_POST['name'];
checkOK($name);
$email=$_POST['email'];
checkOK($email);
$confirmail=$_POST['confirmail'];
checkOK($confirmail);
$month=$_POST['month'];
checkOK($month);
$day=$_POST['day'];
checkOK($day);
$year=$_POST['year'];
checkOK($year);
$leaving=$_POST['leaving'];
checkOK($leaving);
$hour=$_POST['hour'];
checkOK($hour);
$minutes=$_POST['minutes'];
checkOK($minutes);
$ampm=$_POST['ampm'];
checkOK($ampm);
$going=$_POST['going'];
checkOK($going);
$flightnumber=$_POST['flightnumber'];
checkOK($flightnumber);
$pay=$_POST['pay'];
checkOK($pay);
$song=$_POST['song'];
checkOK($song);
$comments=$_POST['comments'];
checkOK($comments);
$to="beepbeepyeah@kabeoke.com";
$message="Message Type: $select\n\nName: $name\n\nEmail: $email\n\n$confirmail\n\nDate of Journey: $month, $day, $year\n\nLeaving From: $leaving\n\nDeparture Time: $hour:$minutes $ampm\n\nGoing to: $going\n\nFlight Number: $flightnumber\n\nPayment Method: $pay\n\nSong Requests: $song\n\nComments: $comments";

header('Location:http://www.kabeoke.com');
if(mail($to,"Slap it - booking/enquiry from Kabeoke.com!",$message,"From: $email\n")){

}
else
{
echo "There was a problem sending the mail. Please check that you filled in the form correctly.";
}


?>

I wrote a small PHP with SQLite script which stores the IP with counter, it works fine with one problem, If I enter the correct password 4th time the counter becomes 4 and I get the error to enter my captcha. All the other times, 1-3 and 5 and above count it just works fine. What am I doing wrong with the logic.   Attaching the zip file with code.   https://drive.google...dit?usp=sharing

I want to limit the number of incorrect login attempts within a specified time period (e.g. 15 minutes). I'm wondering what I should tie those attempts to.

e.g. If too many attempts from one ip address for a specific username, lock them out for 15 minutes? Or too many attempts from any ip address for a specific username? Or too many attempts for an ip address matched loosely (i.e. 255.255.255.0 matching) with a specific username?

What's the best choice? Just too many attempts for a username? Or also use the ip address?

And should I store the attempts in the session, or the DB?

Hi everybody, I want to build a script that lets someone register with a simple form that logs all activity into a MySQL db.

The thing is, I want to log all attempts to signup into the system even if they do not satisfy password strength, or the required fields criteria.

In the following code, the string "email" isn't being used. The field named 'name' is what I'm using to collect the email, and the field named 'msg' is what I'm using to collect the password.

I've gotten to the point where if they don't provide anything for either email or password, then it directs them to the same page and it asks them to re enter their information. but I can't seem to capture the attempt (so if they enter an email but not a pass, i still want to know what email they entered).

I'm getting this error

Parse error: syntax error, unexpected T_ELSE in /hermes/bosweb25c/b1454/ipg.domainname/nameofsite/contact_insert2.php on line 41

Line 41 corresponds to the line with the first "else{"

I'm really not sure what to do, it seems straight forward when I think it through in my head.

If pass or email field is empty, enter it into the db, and then send them back to the beginning, if pass or email field not empty, continue in script.

Code: [Select]

<?php

define('DB_NAME', 'dbname');
define('DB_USER', 'phpchick');
define('DB_PASS', 'password');
define('DB_HOST', 'localhost');

// contact to database
$connect = mysql_connect(DB_HOST, DB_USER, DB_PASS) or die('Error , check your server connection.');
mysql_select_db(DB_NAME);
  
//Get data in local variable
$v_name=$_POST['name'];
$v_email=$_POST['email'];
$v_msg=$_POST['msg'];
 
 // check for null values
if ($v_name==""  or $v_msg=="")
$query="insert into contact(name,email,msg) values('$v_name','$v_email','$v_msg')";
mysql_query($query)  or die(mysql_error());
echo " 
<head>      <link rel=\"stylesheet\" type=\"text/css\" href=\"http://site.com/signup.css\"></head>
<h2>Free Registration</h2>
<form action=\"contact_insert2.php\" method=\"POST\" id=\"insert\">
  <table>
  <tr>
  <td >Email</td>
  <td  ><input type=\"text\" size=40 name=\"name\"></td>
  </tr>
 
  <tr>
  <td >Password</td>
  <td  ><input type=\"password\" size=40  name=\"msg\" ></td>
  </tr>
  You must enter an email and password.
  <tr>
  <td colspan=2 id=\"sub\"><input type=\"submit\" name=\"submit\" value=\"submit\" ></td>
  </tr>
  </Table>
</form>";
else{
if (strcspn($_REQUEST['msg'], '0123456789') == strlen($_REQUEST['msg']))
echo "true";
else{
$query="insert into contact(name,email,msg) values('$v_name','$v_email','$v_msg')";
mysql_query($query)  or die(mysql_error());
echo "Your message has been received";
}
 }
?>

hope you all had a good Christmas/New Year.